Smishing and Scam Texts: The Messages to Delete

A text arrives from a number you don’t know, asking if Sarah is still free for dinner on Thursday. You reply that they have the wrong number. The sender apologizes, thanks you for being kind and asks which city you’re in. In the US Federal Trade Commission’s review of text-scam reports from 2024, that polite reply can be the opening move of a scam: a chat that turns into a friendship and then into a pitch for a fake investment platform.¹

Scam text messages rarely look alike on the surface, but many of them run one of a handful of scripts, and one rule covers all of them. Europol, the EU’s police agency, and the US Federal Trade Commission (FTC) give the same core advice: don’t reply, don’t tap the link or call the number, and reach the real company by a contact you looked up yourself.¹²³ Here are the six steps, in the order you’ll need them:

1. Learn the seven scripts scam texts follow
2. Don’t reply, don’t tap, don’t call back
3. Verify through an app, website or number you already have
4. Report and block the sender on your phone
5. Forward the text to your country’s spam short code
6. If you already replied or paid, start with what you gave away

This page stays with text messages. The account habits behind it, such as never reusing a password and turning on two-step verification, are covered in basic digital safety habits for every account.

Many scam text messages follow seven familiar scripts

Scam texts count on a reflex. The US FTC points out that few people can resist glancing at their phone when a text arrives, and that scammers bet on it. Its 2025 analysis of text-scam reports found that a few scripts cover much of the problem.¹ Agencies elsewhere describe the same patterns.

The study

Moderate evidence

Text-scam losses reported to the US FTC, 2024

People in the US reported losing US$470 million to scams that started with a text message in 2024, more than five times the 2020 figure, even though the number of reports fell. When FTC staff hand-coded a random sample of 1,000 reports that described the scam, five scripts (fake delivery problems, job offers, bank or shopping fraud alerts, unpaid tolls and “wrong number” chats) accounted for roughly half the text frauds reported.¹

Treat the dollar figure as a floor. It counts only what people chose to report, and the FTC itself says most frauds never are. Reports fell while reported losses rose, which the FTC reads as a sign that scammers’ odds of a big payout have improved.¹

Here are the scripts to know, with the tell that gives each away.

The toll row is the one to adapt to where you live. It comes from US reports, but the shape travels: any text claiming you owe a charge and offering a link to pay deserves the same suspicion, whatever agency it names.

The “Hi Mum” script shows how little a scammer needs. Australia’s Competition and Consumer Commission (ACCC) said in 2022 that these messages most often arrived on WhatsApp, from someone claiming a lost or broken phone, and Australians reported losing A$2.6 million to them in the first seven months of that year.⁴ A kind, slightly rushed parent is enough.

So learn the scripts. The wording changes all the time; the request at the end does not. Before you act on any unexpected text, look at what its last line asks for: a payment, a tap, a reply or a code.

1. An unknown sender. Nothing in a text proves who sent it, and a personal touch, such as your name, proves nothing either.
2. A delivery problem. Fake delivery problems are one of five scripts behind roughly half the text frauds in the US FTC's sample of reports.
3. A small fee. The small fee is the bait for your card details.
4. The request in the last line. The wording changes all the time; the request at the end does not. Here it is a payment; elsewhere a tap, a reply or a code.
5. A link to pay. It leads back to the sender, not to the courier. Check through a website or app you find yourself.

Why “don’t reply, don’t click, verify another way” works

Every contact route a scam text offers you leads back to the sender, so the only safe check is one that goes through a route you found yourself. Europol’s 2018 awareness sheet, still linked from its current scams guide, puts it plainly for bank texts: the link leads to a bogus website, and the phone number leads to a fraudster pretending to be the bank.³

The bank-alert script shows the mechanism. The text says a large payment is pending and asks you to reply NO if it wasn’t you. You reply, and a “fraud team” calls. The FTC describes what comes next: the caller says all your money is at risk and pressures you to move it to a “safe” account, which belongs to the scammers.¹ Nothing in that chain required a link.

That’s why the rule has three parts. Don’t reply, because a reply can start the conversation the scammer wants. Don’t tap or call, because those routes are theirs. And verify another way: the FTC’s 2022 consumer advice is to reach the company through a phone number or website you know is real, not the details in the text.²

For family messages, the ACCC’s advice is to call your son, daughter or friend on the number already saved in your phone, and never to send money until you’re sure who is receiving it.⁴ That call takes a minute, and it reaches the real person rather than the sender.

Myth

A text that knows my name, or my child's name, must be genuine.

Fact

The US FTC warns that scammers may know some things about you and sound very convincing. A personal touch proves nothing about who sent the text.

One-time codes need their own rule. The FTC compares your password and a verification code to a doorknob lock and a deadbolt: a scammer needs both, which is why they pose as someone you trust and ask for the code. The FTC’s 2024 alert leaves no room for exceptions: in its words, anyone asking for your account verification code is a scammer.⁵

Make “I’ll check another way” your automatic answer, since a real bank, courier or relative can wait five minutes.

How to block and report scam texts on iPhone and Android

Both main phone systems let you report a scam text and block its sender in a few taps, and on many networks the report also reaches your mobile provider. Apple and Google describe the steps on their help pages, and the order matters: report before you reply to anything, or delete it. If a toll notice arrives from a number you don’t know, deleting it clears your screen; reporting it first, on many networks, also puts a copy in front of the people who can block the sender.

On an iPhone

In Messages, a Report Spam link appears under a text from an unknown sender: tap it, then tap Delete and Report Spam. Without opening the text, you can swipe left on it and do the same. Apple notes that you can’t report a message after you’ve replied to it, and that, depending on your carrier and country, reporting a text shares it with your carrier. Reporting doesn’t stop the sender writing again, though. To do that, open the conversation, tap the sender’s icon, then Info, and choose Block Contact.⁶

On an Android phone

In Google Messages, touch and hold the conversation, then tap Block, Report spam and OK. Reporting also blocks the sender and moves the conversation to the “Spam & blocked” folder, and Google says a report may send a copy of the number and the latest message to your mobile carrier.⁸

If your phone uses a different messaging app, look for its junk or spam option before you delete the text.

So the order is report, then block, then delete. Replying first closes the report option on an iPhone, and deleting first throws away the copy your provider could have used.

Forward the text to your country’s spam short code

In several countries you can also forward a scam text, free, to a short code that goes to mobile networks or a government team: 7726, which spells SPAM on a phone keypad. Countries run these services differently, so check what yours offers.

• In the UK, most providers accept texts forwarded to 7726, and the National Cyber Security Centre (NCSC) says your provider can then investigate the sender and block it. Note the sender’s number first, as the NCSC’s steps suggest. The NCSC says the service had helped remove about 41,000 scams as of July 2026.⁹
• US readers can copy the message and forward it to 7726, which the FTC says helps providers spot and block similar texts, and can also report it through the FTC’s ReportFraud.ftc.gov site.²
• In Canada, Get Cyber Safe says forwarding to 7726 is free and alerts your provider, which can block similar messages for all users.¹⁰
• In New Zealand, the Department of Internal Affairs runs the 7726 service, and it says using Report Junk or Report Spam in your messages app also shares the text with it.¹¹
• In Australia, Scamwatch takes scam reports through an online form.¹²

A forward costs you a minute. Because providers can use these reports to block similar messages for their other customers, your one text can help keep the same scam away from other people.

Already replied, tapped or paid? Start with what you gave away

Once you’ve engaged with a scam text, move quickly, and let what you handed over decide the next step. Britain’s NCSC organizes its advice, last reviewed in 2022, by situation. If you’ve given out banking details, contact your bank. If you typed in a password, change it there and on every other account where you reused it, and consider a passkey where one is offered. If a link led you to install something, run a full antivirus scan. If the message reached you on a work phone or laptop, tell your IT department.¹³

1. 1Money or card detailscall your bank on a number you trust
2. 2A passwordchange it everywhere you used it
3. 3A code, or the account looks hackedfollow that service’s account recovery steps
4. 4Installed somethingrun a full antivirus scan
5. 5Report itto your police or national fraud service

If money or bank details are involved, call your bank using a number you trust, such as the one on your statement or in its app, not a number from the text.⁵

If you replied but shared nothing, block the sender and forward the text to your reporting service. Treat any “fraud team” that calls you next as part of the same scam, like the one in the bank-alert script.

Then report it to your local police or your national fraud reporting service; check which one handles scams where you live. In the UK, for example, the NCSC points people to Report Fraud (0300 123 2040) covering England, Wales and Northern Ireland, and to Police Scotland on 101.⁹ Getting money back depends on your bank, your country and how you paid, a question too large for this page; your bank and your national fraud service can tell you what applies to you.

If the sender threatens you, or you or someone else is in immediate danger, call your local emergency number first. Australia’s Scamwatch, for example, says to call 000 when anyone is in immediate danger, and it can connect people who need support to recover from a scam with IDCARE, a support service. Report even if the loss feels small or embarrassing: Scamwatch says reports help it warn others.¹²

When a suspicious text arrives

• Do not reply, tap the link or call the number in it
• Check through an app, website or saved number I already trust
• Never share a verification code with anyone
• Report it as spam or junk in my messages app, then block the sender
• Forward it to 7726 or my country’s reporting service
• If I paid or shared details, call my bank on a number I trust

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

Agencies agree, but nobody has tested the rule

The advice on scam texts rests on agreement between agencies: we could not find a single study testing whether people who follow it lose less money. What it has instead is convergence, since agencies in the US, the UK, the EU, Canada, New Zealand and Australia, each writing its own guidance, arrived at the same rule. The script list rests mostly on observational data, a hand-coded sample of US reports, so read its proportions as a guide to what is common.

The weakest link is measurement. Nobody counts the scams that fail because someone paused and checked, so the official figures cannot show how much the rule prevents. Following the rule costs you a minute of checking.

The bottom line

Scam texts change their wording constantly but keep asking for the same things: a tap, a reply, a payment or a code. Refuse all four, check anything that worries you through an app or number you already have, and report the text before you delete it. If you’ve already paid or shared details, call your bank first and report the scam second.