"Smishing" — SMS phishing — has quietly become one of the most effective scam formats there is, precisely because text messages carry an unearned sense of legitimacy. People who'd never click a suspicious email link will tap a text that claims to be their bank without a second thought, because texts feel personal and immediate in a way email doesn't. This guide covers how to recognize the major categories of scam texts, the specific things you should never do when one arrives, and how to block scam text messages so they stop reaching you at all.

Why scam texts work better than scam emails

A few structural reasons text-based scams have gotten so effective:

The major categories of scam texts

Fake package delivery notices

"Your package could not be delivered, click here to reschedule" — sent whether or not you're actually expecting a delivery, because scammers know enough people are that the message lands convincingly often. These typically link to a fake payment page asking for a small "redelivery fee," which is really just a card-skimming form.

Red flag: Legitimate couriers (USPS, FedEx, UPS, DHL) rarely ask for payment via text link for standard redelivery, and their real tracking links go to their actual domains, not a shortened or unfamiliar URL.

Bank fraud alerts

"Unusual activity detected on your account, verify now" — designed to trigger panic and immediate action before you think to question it. These links lead to convincing fake login pages that harvest your actual banking credentials the moment you type them in.

Red flag: Real banks generally don't ask you to "verify your account" by tapping a text link and entering your full login credentials on a page that opens from that link. If in doubt, close the message and open your bank's app directly instead.

Fake job offers

Often targeting people actively job-hunting — "We reviewed your resume, remote position available, $35/hr, reply YES to start." These can lead to two different scams: a "hiring fee" or "equipment fee" you're asked to pay upfront, or a check-fraud scheme where they send you a fake check to deposit and ask you to wire back a portion, which bounces after you've already sent real money.

Red flag: A job offer arriving unsolicited via text, for a role you never applied to, with unusually high pay for minimal described work, is close to always fraudulent.

Romance scams

Less immediate than the others — these often start as a "wrong number" text ("Hey Alex, are we still on for dinner?") designed to start a conversation. Over weeks, the scammer builds a relationship before eventually requesting money for an emergency, travel costs to visit, or an "investment opportunity."

Red flag: Any online-only relationship that moves toward requests for money, cryptocurrency, or gift cards — regardless of how long the relationship has been building or how convincing it feels — is worth stopping and verifying independently.

Government and tax scams

Impersonating tax authorities, toll agencies, or benefits programs — "unpaid toll, pay now to avoid penalty" is a particularly common recent variant. These rely on the authority of the impersonated institution to short-circuit skepticism.

Red flag: Government agencies and toll authorities generally do not initiate collection via unsolicited text with a payment link. Check directly through the agency's official app or website, typed manually rather than tapping the link.

Prize and lottery scams

"Congratulations! You've won a $1,000 [retailer] gift card, claim now" — one of the oldest scam formats still running, precisely because it works on a simple emotional hook rather than fear or urgency. Unlike a bank-fraud or delivery text, there's no real institution being impersonated, which paradoxically makes these easier to spot once you know the pattern: you didn't enter a contest you don't remember, and legitimate sweepstakes never require payment, personal banking details, or a "processing fee" to release a prize you supposedly already won.

Red flag: Any message announcing you've won something you never entered, especially one asking for any form of payment or sensitive information before you can "claim" it, is a scam without exception. Legitimate prizes don't require you to pay to receive them.

What you should never do

Never reply STOP to a number you don't recognize

This is one of the most counterintuitive but important pieces of advice here, and it directly contradicts the standard "reply STOP" guidance for legitimate marketing texts. For a legitimate business, STOP works because they're required to honor opt-outs. For a scam number, replying anything — including STOP — confirms to the scammer that your number is active and monitored by a real person, which makes it more valuable for future targeting, not less. If you don't recognize the sender and the message looks even slightly off, don't reply at all. Block and report instead.

Never tap the link, even "just to look"

Some phishing pages are built to fingerprint your device or attempt exploits the moment the page loads, before you've entered anything. Treat unexpected links from unfamiliar senders as something to avoid opening entirely, not something to cautiously inspect.

Never call the number in the text

If a message claims to be your bank and provides a callback number, that number typically routes to the scammer, not your actual bank. If you want to verify, find your bank's number independently — from the back of your card, or their official app — rather than trusting a number provided in the suspicious message itself.

How to actually block scam texts for good

Report before you block

In the US, forwarding a suspicious text to 7726 (spells "SPAM") reports it to your carrier's spam-filtering system, which helps improve detection for everyone, not just you. It takes seconds and doesn't require replying to the scammer directly.

Block the number

Standard contact blocking stops that specific number. It's a reasonable first step but a limited one — scam operations routinely rotate through large pools of numbers specifically to survive this kind of individual blocking.

Block by pattern, not just by number

This is the part that actually solves the rotating-number problem. Scam texts follow structural patterns even when the sending number changes — similar link-shortener domains, similar message templates, similar notification behavior. JunkNot works at exactly this level: swipe a scam text notification away, tap "JunkNot it forever," and the pattern is blocked, not just the individual number. The next delivery-scam text from a completely different number is caught by the same rule, because it matches the same underlying pattern. If you want this handled automatically instead of swiping each new variant as it arrives, Pro's AI Autopilot detects and blocks matching spam before you ever see the notification — genuinely useful for scam campaigns, which tend to arrive as a burst of near-identical messages from different numbers over a short window.

What to do if you already clicked

If you tapped a phishing link and entered any information: change the password for that account immediately from a source you trust (not the link you clicked), enable two-factor authentication if it isn't already on, and contact your bank if any financial details were entered, since they can flag the account for monitoring or reissue a card. Acting within the first hour meaningfully reduces the damage window compared to waiting.

Decoding a few real-world scam text patterns

Scam texts follow recognizable templates once you know what to look for. Breaking down the structure helps more than any single rule, because it teaches you to spot the shape of a scam even in a variant you haven't seen before.

The urgency-plus-link pattern

"Your account will be suspended in 24 hours unless you verify now: [link]." The core mechanic here is manufactured time pressure combined with a single, immediate action. Legitimate institutions rarely combine hard deadlines with a single unverified link as the only resolution path — they typically offer multiple ways to address account issues, including through their official app, without requiring you to act within a specific short window.

The small-amount pattern

Delivery-fee and toll scams tend to request suspiciously small amounts — a few dollars. This is deliberate: a request for $2.99 triggers far less scrutiny than a request for $200, even though the actual goal (harvesting your card details) is identical. The dollar amount is a psychological lever, not a meaningful signal of legitimacy.

The familiar-institution-wrong-detail pattern

A message might correctly reference a real bank or service you use, but get one detail wrong — the wrong last four digits of an account, a generic greeting instead of your name, a slightly off domain in the link. Scammers often send the same template broadly and rely on it occasionally matching a real customer's actual bank, so hitting "close enough" alongside a real institution's name is a mass-targeting strategy, not evidence the sender actually knows your account.

The slow-build pattern

Romance and long-con scams don't ask for anything in the first message — they build a plausible, patient relationship over days or weeks specifically because a request for money in message one would be obviously suspicious. The absence of an immediate ask is not itself reassuring; it's often part of the technique.

Protecting family members who are more vulnerable to these scams

Older adults and people less familiar with common scam patterns are disproportionately targeted, and it's worth taking a couple of concrete steps beyond just explaining the risks verbally, since general warnings are easy to forget in the moment a real scam text arrives.

Set up blocking on their behalf

Installing a pattern-based blocker like JunkNot on a family member's phone, with their permission, adds a layer of protection that doesn't rely on them correctly identifying every scam in real time — the notification-pattern blocking works the same way regardless of how convincing an individual message looks to the recipient.

Establish a "call me first" rule

A simple agreed-upon rule — "before you click any link about your bank or a package, call me or call the company directly first" — creates a pause point that breaks the urgency mechanism most scam texts rely on. The goal isn't to catch every scam through vigilance; it's to build in a default delay before any action is taken on an unexpected message.

Talk through real examples together

Walking through an actual scam text together — including this article's breakdown of the urgency-plus-link and small-amount patterns — tends to stick better than a generic "watch out for scams" warning, because it gives a concrete template to pattern-match against rather than an abstract category to remember.

Why scam texts have accelerated in recent years

A few converging factors explain why smishing volume has grown so sharply rather than staying flat. Bulk SMS sending infrastructure has become cheaper and more accessible, lowering the barrier for running large-scale campaigns that would have required real technical infrastructure a decade ago. Data breaches at various companies have put large volumes of real phone numbers, and sometimes names or partial account details, into circulation, letting scam campaigns feel more personalized and convincing than a fully random blast would. And two-factor authentication becoming more widespread has, somewhat counterintuitively, created new scam angles — "your verification code" phishing texts that try to trick people into forwarding a real 2FA code to an attacker in real time during an active account-takeover attempt, exploiting the fact that people have been trained to expect and act quickly on short numeric codes arriving by text.

The verification-code scam specifically

This one deserves its own callout because it inverts the usual pattern: instead of a link, the scammer already has your username and password (often from a breach) and triggers a real login attempt, which sends you a real verification code from the real service. They then text or call you, often impersonating that service's support team, asking you to "confirm" the code you just received. The code is real; the request to share it is the scam. No legitimate service will ever ask you to read back a verification code you received — the code is meant to stay with you and be entered only on the service's own login screen, never shared with anyone who contacts you about it.

Building the habit that matters most

Every specific red flag covered in this guide is useful, but the single habit that catches the widest range of scam texts, including variants no one has documented yet, is simple: treat any unexpected message that combines urgency with a request for money, credentials, or a tap-through link as suspicious by default, regardless of how legitimate the sender name looks. Verification, when needed, should always happen through a channel you initiated yourself — opening the bank's app directly, calling a number from the back of your card, checking a delivery status on the courier's actual website typed in manually — never through a link or number supplied by the message under scrutiny. This single default, applied consistently, closes off the mechanism nearly every scam text variant depends on, which is what makes it more durable than memorizing an ever-growing list of specific scam formats.

Frequently Asked Questions

Why do scam texts often come from a number with my own area code?

Caller ID and sender ID spoofing lets scammers display a number that looks local or familiar, increasing the chance you'll trust and open the message. The displayed number frequently has no relationship to where the message actually originated.

Is it safe to reply STOP to any text?

Only to senders you recognize as legitimate businesses. For unknown or suspicious numbers, don't reply at all — replying, including with STOP, confirms your number is active to a scammer.

Do scam texts ever come from contacts already in my phone?

Rarely directly, but a related pattern exists: if a contact's number is compromised or spoofed, a message can appear to come from someone you know. Be cautious of unusual requests (urgent money transfers, unexpected links) even from apparently known senders.

Can blocking a scam number stop the whole campaign?

Not usually — most scam operations send from large rotating pools of numbers specifically to survive individual blocks. Pattern-based blocking catches the campaign structure rather than one number, which holds up much better against this.

What's the fastest way to report a scam text?

In the US, forward it to 7726 (SPAM) — this reports it directly to your carrier's spam system. You can also report to the FTC at reportfraud.ftc.gov for a formal record, particularly useful if money was actually lost.

Does JunkNot see the content of scam texts to detect them?

JunkNot reads notification metadata — sender, app, category, structural pattern — not the full private content of your personal messages, and nothing is sent off your device for classification. It's built to recognize the pattern of a message you've already flagged as junk, not to scan your inbox.