Phishing scams delivered via text message are increasingly sophisticated, often mimicking legitimate communications from delivery services, banks, or toll agencies. These deceptive messages aim to trick recipients into clicking malicious links, which can lead to financial losses or the compromise of personal information. Halimah Delaine Prado, Google General Counsel, has noted a rise in AI-powered phishing scams, with criminals using artificial intelligence to create convincing fake websites.

Kurt "CyberGuy" Knutsson, a tech journalist, advises a proactive approach to combatting these threats by employing a simple six-step test before interacting with suspicious messages.

The Scam Text Test

When a text message prompts you to click, pay, verify information, or address a problem, it's crucial to pause and consider the following questions:

  1. Was I expecting this? If you aren't anticipating a package, don't use the purported bank, or haven't recently used the mentioned toll service, the message is likely suspicious. Even if there's a coincidental match, proceed with caution.

  2. Is it trying to rush me? Scammers frequently use phrases like "Act now," "Final warning," or "Account suspended" to create a sense of urgency. This pressure tactic is designed to prevent you from verifying the message's legitimacy. Taking a moment to verify can avert significant problems.

  3. Does the link look off? Examine links for misspellings, extra characters, shortened URLs, or web addresses that closely resemble legitimate ones but use different domains. Even if a link appears valid, it's best to avoid opening it in an unexpected text.

  4. Is the message generic or awkward? Pay attention to vague greetings (e.g., "Dear customer" instead of your name), unusual wording, poor grammar, or missing specific details like an order number. While AI can improve message quality, these signs can still indicate a scam.

  5. Is it asking for information no company should request by text? Be wary of any text requesting passwords, credit card numbers, bank login details, Social Security numbers, or immediate payment. Legitimate companies may send one-time verification codes, but they will not ask you to share that code with anyone.

  6. Can I verify it without using the text? This is the most critical step. Instead of using the provided link or phone number, go directly to the company's official app, type its website address into your browser, or call a trusted number from your card or bill. If the issue is real, you will find it through these secure channels.

Common Scam Text Categories

Scam texts often fall into predictable patterns:

  • Fake delivery alerts: These messages claim package delays or require small payments for delivery, often leading to fake sites that steal financial information.
  • Fake bank alerts: Texts may report unauthorized card usage or account lockouts, sometimes including a scammer posing as a bank representative.
  • Fake toll notices: These scams demand small payments to avoid larger penalties, with the payment page designed to steal financial data.
  • Fake account warnings: Messages threaten account suspension for services like email or streaming, directing users to fake login pages.

Responding to Scams

If you have already interacted with a suspicious text:

  • If you clicked a link: Close the page immediately, avoid downloading anything or entering information, and clear your browser history. Monitor for unusual activity.
  • If you entered a password: Change the password immediately on all accounts where it was reused, enable two-factor authentication, and review recent account activity.
  • If you shared a one-time code: Change the account's password at once and check for any new devices, email addresses, or phone numbers added. Contact the company directly to report potential unauthorized access.
  • If you entered payment details: Contact your bank or card issuer immediately to report the incident, consider locking or replacing the card, and monitor transactions for unauthorized charges.
  • If you entered your Social Security number: Visit IdentityTheft.gov to create a recovery plan and consider placing a fraud alert or security freeze on your credit files.
  • If you downloaded something: Run a security scan, remove suspicious apps or files, review recently installed apps, check for unfamiliar permissions, and update your operating system and security software.

Reporting scam texts by using your phone's "Report Junk" or "Report Spam" feature, forwarding messages to 7726 (SPAM), and reporting to the Federal Trade Commission at ReportFraud.ftc.gov, helps authorities identify and combat ongoing campaigns.

While good habits are the primary defense, antivirus software can provide an additional layer of protection by identifying suspicious links and malicious downloads. However, no security tool is foolproof, and careful judgment remains essential.