Quick answer: Text-message scams — known as smishing — use urgent, brand-impersonating messages about deliveries, bank alerts, unpaid tolls, or tech support to trick you into clicking a malicious link or replying with personal information. Never tap a link in an unexpected text; instead, go directly to the company’s app or website, or call the number printed on your card or statement.
That “Your package is on hold” text might look harmless — until it drains your bank account. Text-message scams, known as smishing (SMS phishing), are now one of the fastest-growing consumer fraud categories in the country. In 2024, the FTC reported that Americans lost $470 million to text scams — more than five times what was lost in 2020. Text messaging has now overtaken phone calls as scammers’ preferred way to reach people, according to FTC complaint data.
Here’s how these scams work, the newest variations to watch for, and exactly what to do if one gets you.
A Real Example: The Unpaid Toll Text Scam
Since early March 2024, the FBI’s Internet Crime Complaint Center has tracked a massive, coordinated smishing campaign impersonating state toll agencies — including E-ZPass, FasTrak, and others across at least a dozen states. The messages follow a near-identical script: “[Toll Service Name]: We’ve noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit [link] to settle your balance.”
By the end of 2024, the FBI had logged more than 60,000 complaints tied to this single campaign, and researchers have identified over 20,000 domains registered specifically to impersonate legitimate toll operators. The links lead to convincing fake payment pages designed to harvest credit card numbers and personal details. The FBI’s guidance for anyone who receives one of these texts: don’t click the link, check your toll account directly through the agency’s official website or app, and report the message to IC3.
This campaign matters beyond tolls specifically — it’s a template scammers have since reused for fake DMV notices, traffic citation alerts, and unclaimed-property texts, all following the same “small amount owed, urgent deadline, one link” structure.
Why Text Scams Are So Effective
- People check texts almost instantly.- Unlike email, which many people batch-check, texts get opened within minutes — leaving little time to pause and think.
- They exploit familiar brands.- Messages impersonate companies you likely already have a relationship with: your bank, UPS, Amazon, or your mobile carrier.
- AI has removed the old warning signs.- Generic, error-filled mass texts have given way to messages with realistic names, correct-looking tracking numbers, and clean grammar.
- SMS has less built-in filtering than email.- Most phones don’t have spam protection as mature as inbox spam filters, so more scam texts reach you unfiltered.
Common Scam Themes to Watch For
- Fake deliveries — “Your parcel can’t be delivered until you confirm your address” (USPS, UPS, FedEx, and Amazon are the most commonly spoofed brands).
- Bank and fraud alerts — “Your account has been locked for unusual activity. Tap to verify.”
- Unpaid tolls or tickets — “You have an outstanding toll balance” or “unpaid traffic citation,” often naming a real regional toll authority.
- Tech support scares — “Your phone has a virus. Tap to fix now.”
- Prize, refund, or unclaimed-property offers — “You’ve won! Claim within 24 hours” or “You have unclaimed funds waiting.”
- Government impersonation — Fake IRS, Social Security, or benefits-related texts, a category where the FBI reported losses nearly doubled to $797.9 million in 2025 across phone and text impersonation combined.
How to Verify a Text Message Before You Act
- Never tap the link. Go to the company’s official app or type their website address directly into your browser instead.
- Don’t call the number in the text. Look up the company’s real customer service number independently — on your card, a past statement, or their verified website — and call that instead.
- Check your account directly, through the official app or website, to see whether the alert is real.
- Search for the exact wording of the text (“outstanding toll amount,” for example) — widescale smishing campaigns are frequently reported and documented by news outlets and government agencies once they surface.
- When in doubt, wait 24 hours. Legitimate account issues don’t disappear if you take a day to verify; scam links depend on you acting before you check.
What to Do If You Already Clicked or Replied
- Don’t enter any more information if a page is asking for it — close the browser tab immediately.
- If you entered financial information, call your bank or card issuer directly using the number on your card and ask about freezing the card or blocking the transaction.
- If you entered login credentials, change that password immediately, and change it anywhere else you reused it, then turn on two-factor authentication.
- If you downloaded anything, run a malware/security scan on your phone and consider a factory reset if the app store or scan flags something you can’t remove.
- Screenshot the message and any linked page before deleting, in case you need to dispute charges or file a report.
- Report the text by forwarding it to 7726 (SPAM), which routes it to your mobile carrier for blocking, and file a report at IC3.gov (FBI) or ReportFraud.ftc.gov (FTC).
- Monitor your accounts and credit for at least a few weeks afterward — many smishing campaigns are followed by account takeover attempts using the stolen details.
Text scams aren’t the only way scammers reach your phone — voice calls (vishing), QR codes, and social media messages use similar tactics. See our guide to “vishing, QR-code scams, and social media scams” for the full picture.
Protect Your Phone Going Forward
- Keep your phone’s operating system and apps updated — many security patches close holes scammers rely on.
- Disable automatic link previews in your messaging app to avoid pages loading before you’ve decided to visit them.
- Install a reputable mobile security app with real-time phishing/link protection if your carrier doesn’t already filter scam texts.
- Block unknown senders, and don’t reply “STOP” to a scam text — replying confirms your number is active and can increase future targeting.
People Also Ask
Smishing is phishing carried out through SMS text messages instead of email. Scammers impersonate a trusted brand — a delivery company, bank, or government agency — and use urgency to get you to click a malicious link or reply with personal information.
Don’t click the link. Instead, check your account status directly through the company’s official app or website, or contact them using a phone number you already know is real, not one provided in the text. Widely reported campaigns, like fake unpaid-toll texts, follow a near-identical script across thousands of victims.
Close the page without entering information if you haven’t already. If you did enter financial or login details, contact your bank immediately, change any reused passwords, enable two-factor authentication, and report the text by forwarding it to 7726 (SPAM).
Simply receiving a text is not dangerous on its own. Risk comes from clicking a link, downloading a file, or replying with information. However, replying — even with “STOP” — can confirm your number is active, which may lead to more scam attempts.
Text messaging has overtaken phone calls as a leading scam contact method, and FTC data shows reported text scam losses grew roughly fivefold between 2020 and 2024. Email phishing remains a larger overall category, but smishing is the fastest-growing.
Sources: Federal Trade Commission, Data Spotlight on Text Scams (April 2025) and consumer.ftc.gov; FBI Internet Crime Complaint Center (IC3), toll-scam public service announcements and 2025 Internet Crime Report
Related Posts:
Leave a Reply
You must be logged in to post a comment.