FreeurlA text arrives with a link and a reason to hurry. Maybe it says a package is stuck, a toll is unpaid, or your bank account is locked. Before you tap, you need a fast way to decide. This guide shows you how to tell if a text message link is a scam, using checks you can finish in about a minute.
The short answer: treat any unexpected text with a link as unsafe until you prove otherwise. Do not tap it, do not reply, and look up the company yourself through its official app or website. The rest of this post explains the signs, shows a worked example, and covers what to do if you already tapped.
What makes a text message link suspicious?
Scam texts, often called smishing (SMS phishing), aim to get you to tap a link that leads to a fake login page, a payment form, or a malware download. The link is the whole point of the message. So the message is built to make you tap before you think.
Three things show up again and again. The message is unexpected. It pushes urgency ("act within 24 hours"). And it asks you to do something through the link instead of through an app or number you already trust. Any one of these is a reason to slow down. All three together is a strong warning.
Seven checks before you tap
1. Did you expect this message?
Ask yourself if you ordered a package, used a toll road, or opened a new account. If not, the text has no reason to exist. Scammers send the same message to huge lists and count on a few people having a real package or account that matches by chance. A match proves nothing.
2. Does it create pressure?
Look for deadlines, threats of fines, locked accounts, or "final notice." Real companies do send alerts, but they rarely demand payment or a password through a text link on a tight clock. Pressure is a tool for stopping you from checking.
3. Is the sender a regular phone number or an odd one?
A bank or carrier usually texts from a short code (a five or six digit number) or a consistent business number. A random 10-digit mobile number, or an email address sending a text, is a red flag. Caller names can be spoofed, though, so a good-looking sender does not make a message safe. Use this check to raise suspicion, not to clear a message.
4. Read the domain, not the brand name
The domain is the part right before the first single slash. In https://usps.tracking-update.example/abc, the real domain is tracking-update.example, and "usps" is just a subdomain anyone can add. Look at the last two parts before the first slash. If they are not the company's actual domain, stop.
Also watch for look-alikes: an extra word ("bank-secure-login"), swapped letters, or an odd ending such as .top, .xyz or .help on a message about your bank. Odd endings are not proof on their own, since legitimate sites use them, but a major bank texting you from one deserves doubt.
5. Be careful with shortened links
A short link hides where it goes. Plenty of honest people use them, including us, but scammers like them for the same reason: you cannot read the destination. Our guide on whether short links are safe covers the general risks, and checking a Bit.ly link before you click it shows the method in detail.
The simplest move is to expand the link without visiting it. Paste it into an unshorten tool and read the full address it leads to. Then apply check 4 to that address. One honest limit: an unshortener shows you where a link points. It cannot promise the page is safe, and a brand-new scam site may look clean to any tool. Use it to spot obvious mismatches, not as a stamp of approval.
6. Does the link ask for something sensitive?
If the page it opens asks for a password, a one-time code, your Social Security number, card details, or a small "redelivery fee," close it. A real package carrier does not need your card to reschedule a delivery, and no legitimate service asks you to read back a login code.
7. Can you reach the same task without the link?
This is the check that settles it. Open the company's app, or type its address into your browser yourself, and look for the same notice. Call the number printed on your card or a recent statement. If the problem is real, it will show up there. If it is not there, the text was fake.
A worked example
Say you get this text: "Your package could not be delivered. Confirm your address within 12 hours to avoid return: hxxp://track-parcel-help.example/r/8ks2."
Walk through it. You were not expecting a package, or maybe you were, which is what makes it tempting. It sets a 12-hour clock (check 2). The domain is track-parcel-help.example, which belongs to no carrier you know (check 4). It wants an address confirmation, which usually leads to a fee page (check 6). So you do not tap. You open the carrier's app, or go to its website by typing the address, enter your tracking number if you have one, and see that nothing is wrong. Total time: under a minute.
Now the same text with a short link instead of the full address. You cannot read the domain, so you expand it first. If it resolves to the same kind of unfamiliar domain, you have your answer. If it resolves to the carrier's real domain, you still go to the app for step 7 because a real-looking address can be copied or spoofed in other ways.
Common text scams to recognize
The stories change, but the shape stays the same. These come up most often in the US:
- Package delivery problems. A missed delivery, an address "issue," or a small fee.
- Unpaid tolls or traffic fines. A link to pay a balance you may not owe.
- Bank or card alerts. A "suspicious charge" that asks you to log in through the link.
- Wrong-number openers. A friendly message with no link at first, used to start a conversation that moves toward money or investments later.
- Prize, refund, or job offers. Money you did not ask for, with a link to "claim" it.
The same trick now appears on printed codes too. If a poster or sticker asks you to scan and pay, read what quishing is and how to spot a fake QR code sticker.
What should you do if you already tapped the link?
Do not panic. Tapping alone often does nothing worse than load a page. The risk grows with what you did next.
- Close the page. Do not enter anything else.
- If you typed a password, change it on the real site right away, and anywhere else you reused it. Turn on two-factor authentication.
- If you entered card details, call the number on the back of the card and ask the issuer to block or replace it.
- If you shared your Social Security number, visit IdentityTheft.gov, run by the Federal Trade Commission, for a recovery plan.
- If an app or file downloaded, delete it, then run a security scan on your phone.
How do you report a scam text?
Reporting helps carriers block the sender. Forward the message to 7726 (it spells SPAM), and your carrier will ask for the sender's number in a follow-up. You can also report it to the FTC at ReportFraud.ftc.gov. After you report, delete the text and block the number. The FTC advises against replying, even with "STOP," since a reply tells the sender your number is active. Its page on recognizing and reporting spam text messages has the current steps, and the Better Business Bureau also maintains a guide to scam texts.
If you send texts with links for your business
The flip side matters too. If you text customers, your messages look like scams unless you make them obvious. Use a link on your own domain so people can read a name they recognize, rather than a random-looking string. We explain how in using your own domain for short links. Say who you are in the first line, and never ask for passwords or payment details by text. Honest branding will not make every customer trust a link, and nothing replaces telling people to open your site themselves, but it removes one reason to doubt you.
Frequently asked questions
The answers below also appear in the FAQ section for this post.
Short version: check the domain, verify through the official app or website, and when in doubt, skip the link.
Frequently asked questions
Is it safe to click a link in a text message from an unknown number?
No. Treat any unexpected link as unsafe. Do not tap it or reply. Look up the company yourself through its official app or website, and delete the text.
Can a scam link infect my phone just by tapping it?
Usually tapping only opens a web page, and the main danger is what you type into it or what you download afterward. Still, close the page right away and do not enter any information. Keep your phone's operating system updated.
Should I reply STOP to a scam text?
No. The FTC advises against replying, because it can confirm to the sender that your number is active. Report the message, block the number, and delete it.
How do I report a scam text message in the US?
Forward the text to 7726 (SPAM) and report it at ReportFraud.ftc.gov. You can also report it to your mobile carrier.