TLDR
Scam texts (also called smishing) are designed to look like urgent messages from banks, delivery services, or government agencies. The 8 red flags below will help you identify them. The most important thing to know: 86.7% of malicious domains use .com extensions, so "it looks like a real website" is not a reliable safety check.
Why Scam Texts Are Getting Harder to Spot
ScamVerify™ tracks 69,088 malicious domains through our URLhaus threat intelligence feed. Here is what the data reveals:
| Domain Extension | Malicious Domains | Share |
|---|---|---|
| .com | 59,876 | 86.7% |
| .net | 4,000 | 5.8% |
| .org | 3,996 | 5.8% |
| .xyz | 715 | 1.0% |
| .online | 182 | 0.3% |
| .site | 181 | 0.3% |
The old advice to "avoid sketchy-looking domains" no longer works. Scammers register professional-looking .com domains that closely resemble legitimate businesses.
Red Flag 1: Unexpected Urgency
Scam texts create a false sense of urgency. Common phrases include:
- "Your account will be suspended in 24 hours"
- "Immediate action required"
- "Your package cannot be delivered unless..."
- "Pay your toll balance to avoid penalties"
Legitimate companies rarely demand immediate action via text. Your bank will not close your account because you did not respond to a text within hours.
Red Flag 2: Links That Don't Match the Claimed Sender
The text claims to be from USPS but the link goes to usps-delivery-update.com instead of usps.com. Scammers register domains that look similar but are not the real company.
How to check: Long-press (do NOT tap) any link to preview the actual URL. If the domain does not exactly match the claimed company's official website, it is a scam.
Red Flag 3: Requests for Personal Information
No legitimate company will ask you to confirm your Social Security number, bank account details, or full credit card number via text message. Period.
Red Flag 4: Generic Greetings
"Dear Customer" or "Dear User" instead of your actual name. Scammers send these texts in bulk to thousands of numbers and cannot personalize each one.
Red Flag 5: Too-Good-to-Be-True Offers
"You've won a $500 gift card!" or "Claim your $1,000 stimulus payment." Our FTC data shows 7,470 complaints about lottery and prize scams, and only 36% are robocalls - meaning many come through text and email channels.
Red Flag 6: Unfamiliar Short Codes or Long Numbers
Legitimate businesses typically send texts from short codes (5-6 digit numbers) or their verified business number. Random 10-digit numbers sending "official" notifications are almost always scams.
Red Flag 7: Poor Grammar and Spelling
While AI-generated scam texts are improving, many still contain subtle errors: "Your packge is waiting for delivry" or extra spaces, odd capitalization, and misused punctuation.
Red Flag 8: Requests to Call a Different Number
"Call 1-888-XXX-XXXX immediately to verify your account." This redirects you to a scam call center. If you need to call your bank or a government agency, look up the number independently from their official website.
What to Do When You Receive a Suspicious Text
- Do NOT tap any links in the message
- Do NOT reply - even "STOP" confirms your number is active
- Screenshot the text for your records
- Forward it to 7726 (SPAM) - works on all major US carriers
- Report to the FTC at ReportFraud.ftc.gov
- Check the number or URL on ScamVerify for free
FAQ
Can scam texts install malware just by opening them?
Simply receiving or reading a scam text does not install malware. The danger comes from tapping links, which can lead to phishing sites or malware downloads. However, on rare occasions, specially crafted messages can exploit vulnerabilities in older, unpatched phones.
Why am I getting more scam texts than before?
Phone numbers are widely available through data breaches, data broker listings, and social media. Once your number enters a scam database, it gets sold and reused across multiple operations. ScamVerify tracks over 608,145 unique scam phone numbers in FTC data alone.
Should I block the number after receiving a scam text?
Yes, block it. But know that scammers rotate through numbers constantly. The 833 area code alone has 892 high-complaint numbers in our database. Blocking individual numbers helps but is not a complete solution - combine it with carrier-level spam filtering.
