Scam text messages had become such a regular part of my week that I stopped reading most of them past the first line. A fake delivery notice here, a “toll payment overdue” text there — I’d delete them on autopilot without really looking at what they had in common. So for one month, I screenshotted every single one before deleting it, just to see the pattern once it was laid out in front of me.
Twenty-three texts later, the pattern was a lot clearer than I expected, and a few of them were disguised well enough that I understood why people fall for this.
What a Month of Scam Texts Actually Looked Like
Out of twenty-three texts, the categories broke down into a few repeating themes rather than twenty-three different scams.
- Fake delivery notices made up close to a third of them, almost always claiming a package couldn’t be delivered and needed an address “confirmation”
- Toll or parking payment texts claiming an overdue balance, usually with a short deadline attached
- Bank or account alerts warning about suspicious activity or a locked account
- Prize or reward texts claiming a gift card, refund, or unclaimed payment
Nothing on the list was especially creative. The same handful of formats just kept getting recycled with different sender numbers.
The Pattern Behind Almost All of Them
A few specific traits showed up across nearly every single text, regardless of which category it fell into.
A short link, usually shortened or slightly misspelled. Instead of an official domain, the link almost always used a shortened URL service or a domain that looked close to, but not quite, the real company’s site.
A tight deadline. Nearly every text created urgency — an account being locked, a package being returned, a payment overdue within hours — designed to get a reply before there’s time to think it through.
A sender number that wasn’t a short code. Legitimate notifications from banks, carriers, and delivery services typically come from short, official-looking numbers. Most of the scam texts came from regular ten-digit numbers, often ones that changed between messages even when claiming to be from the same company.
A generic greeting, or none at all. Real account notifications usually reference something specific — an order number, a partial account number. Scam texts almost always stayed vague enough to work on anyone who received it.
Recognizing two or three of these traits together, rather than any single one alone, turned out to be the most reliable signal.
Reporting and Blocking on iPhone and Android
Both platforms make it straightforward to report a text as spam without needing a third-party app.
iPhone: Open the message, tap Report Junk below it if the option appears, or forward the text to 7726 (spells “SPAM”) to report it directly to your carrier.
Android: Open the message, tap the three-dot menu, and select Block & report spam, which sends the same kind of report to Google and your carrier.
Reporting through these channels feeds into the same spam-filtering systems that carriers use for call-level spam blocking, so the two problems are more connected than they first appear.
What to Do If You Already Tapped the Link
Tapping a scam link isn’t automatically catastrophic, but a few steps are worth taking immediately rather than waiting to see if anything happens.
- Don’t enter any information on the page that opens, even if it looks like a real login screen
- Change the password for any account the fake page was impersonating, especially if you did enter anything before realizing
- Turn on two-factor authentication on that account if it isn’t already enabled
- Check whether your information shows up elsewhere, since scam texts targeting a specific person sometimes follow a broader data breach rather than being random
Most tapped links lead to a fake form designed to collect information you’d have to actively enter — simply opening the page without typing anything in rarely causes harm on its own.
Frequently Asked Questions
Why do I suddenly get more scam texts than I used to? Scam text volume often increases after a phone number appears in a data breach or gets sold between spam operations, similar to how spam calls tend to spike for the same reason.
Do scam texts ever come from real, recognizable phone numbers? Occasionally, since some scams spoof a legitimate-looking number the same way spam calls do, though most rely on regular numbers that change frequently rather than convincingly faking a known company’s number.
Is forwarding a scam text to 7726 actually useful, or just symbolic? It genuinely feeds into carrier spam-filtering systems, which use these reports to identify and block sender patterns more broadly, not just for the person who reported it.
Can a scam text infect my phone just by opening it? Standard scam texts rely on you tapping a link and entering information, rather than infecting a device just by being received or opened. The risk comes from what happens after tapping through, not the text itself.
The Real Pattern
A month of scam texts turned out to repeat the same handful of formats over and over, distinguished mainly by urgency, a slightly-off link, and a sender number that wasn’t an official short code. Recognizing that combination catches most of what shows up, even when the specific scam changes.
📍 Read Next: If scam texts have been showing up more than usual, it’s worth checking whether your information turned up somewhere bigger — I Ran My Email Through a Data Breach Checker. It Showed Up 6 Times. covers how to check.