Is this text a scam? How to check a suspicious message
Got a text that feels off? Here is how to check it safely - how to preview a link without tapping it, the scam patterns currently circulating, and why replying (even STOP) makes things worse.
The short answer
- Check it like this: press and hold the link instead of tapping it. A preview shows the real destination, which is usually enough to expose a scam on sight.
- This kind of scam is called smishing - phishing delivered by SMS or messaging app - and it succeeds because phone interfaces hide the information you would normally use to check.
- Texts arrive with far less filtering than email and are read within minutes, which compresses the time available to think.
- Fake unpaid-toll messages drove a 40% rise in government impersonation reports to the FTC in 2025.
- Replying at all, even "STOP", confirms your number is live and monitored - report and delete instead.
If a text message about a toll, a delivery, a bank alert or a job offer feels slightly off, do not tap anything in it. Press and hold any link instead of tapping it — a preview of the real destination appears, and a domain that does not match the organisation it claims to be from settles the question immediately. If there is no link, treat any request to reply, call a number, or "confirm your details" the same way: go to the organisation directly, using an address or number you already know.
This pattern has a name — smishing, a contraction of SMS and phishing — and the attack underneath is identical to email phishing: a credential, a code, a payment, or an installation. What changed is the delivery, and the delivery is why it works so well.
Why the phone is the weaker channel
Every habit built up over twenty years of email security assumes a desktop. Almost none of them survive the move to a four-inch screen.
| Email defence | What happens on a phone |
|---|---|
| Hover a link to see the destination | There is no hover |
| Read the full sender address | Truncated, or replaced by a contact name |
| Notice the design does not match | A text has no design to compare |
| Spam filtering catches it | SMS filtering is far weaker |
| Read it at a desk, deliberately | Read within minutes, while walking |
There is also a quieter psychological factor. Email is a channel full of strangers and marketing; a text message is the channel your family uses. The medium itself carries an assumption of legitimacy that email lost long ago.
What is actually circulating
Unpaid tolls
The dominant pattern. A small outstanding charge, a disproportionate threat about late fees or registration suspension, and a lookalike domain. The FTC identified these messages as a major driver of the 40% rise in government impersonation reports in 2025, spoofing real programmes including E-ZPass, SunPass, FasTrak and TxTag.
Delivery notices
A parcel held for an incomplete address or an unpaid fee of a pound or two. The fee is trivial by design — you are clearing an annoyance, not evaluating a transaction. The object is the card details.
Bank alerts
"Did you authorise a payment of £940 to a new payee? Reply N if not." Replying starts a conversation, frequently continuing by phone with someone who will help you move money to a "safe account".
The wrong-number opener
"Hi Michael, are we still on for Thursday?" No links, nothing to report, no scam visible. It is the opening move of a romance or investment approach, and its function is simply to find out whether you reply.
Job offers
Generic, well-paid, no specifics, usually moving to WhatsApp immediately. See job scams.
Checking a link on a phone
The technique most people never learn: press and hold instead of tapping. A preview appears showing the real destination, and you can read the domain without committing to it.
What you are reading is the part immediately before the first single slash.
In ezpass.toll-payments.co/pay, the actual domain is toll-payments.co —
"ezpass" is a subdomain the attacker chose freely, and it means nothing.
Better still, do not use the link. Open the app or type the address yourself. A genuine notice will be waiting there.
Why replying is worse than ignoring
"STOP" is a legal requirement for legitimate marketing. A scammer is not constrained by it, and a reply tells them the number is live, monitored, and belongs to someone who engages — which is a valuable signal that gets sold.
Do not reply. Report and delete.
Reporting
- UK: forward the message to 7726 (free, spells SPAM)
- US: forward to 7726, and report at ReportFraud.ftc.gov
- Use your phone's built-in "Report Junk" option as well
Then delete it, so you do not tap it absent-mindedly later.
What actually protects you
- Never act on an unexpected text using its link or number. Go to the organisation the way you normally would.
- Turn on your phone's message filtering for unknown senders — both iOS and Android have it, and it is off by default for many people.
- Use passkeys where offered. A passkey will not present itself to a lookalike domain, which removes the entire capture stage.
- Treat any request to move money as fraudulent until verified by calling the number on your card.
Practise on real texts
Our smishing drill puts a phone in your hand with a mix of real and fraudulent messages, including the link-preview check.
Try it freeFrequently asked questions
- How do I know if a text message is a scam?
- Press and hold any link instead of tapping it - a preview shows the real destination, and a mismatched or unfamiliar domain is usually enough to confirm it. Also treat any unexpected message about a toll, a delivery fee, a bank alert or a job offer as suspicious by default, especially if it creates urgency or asks you to reply.
- Why do scam texts work better than scam emails?
- Three reasons. Text messages face far less filtering than email. Phone interfaces truncate or hide URLs, so the standard "check where the link goes" advice is harder to follow. And texts are read within minutes of arriving, usually while doing something else, which is exactly the condition phishing is designed for.
- Should I reply STOP to a scam text?
- No. STOP works for legitimate marketing, which is legally required to honour it. A scam message is not, and any reply confirms your number is active and read by a human — which typically increases the volume you receive. Report and delete instead.
- How do I check a link in a text message safely?
- Press and hold the link instead of tapping it. A preview of the real destination appears and you can read the domain before committing. Better still, do not use the link at all — open the organisation's app or type its address yourself. If the notice is real it will be there.
- How do scammers get my phone number?
- Data breaches, data brokers, and simple sequential generation — numbers are short enough to guess in bulk. Because the number is easy to obtain and the message costs almost nothing to send, smishing does not need to target you specifically to be worth doing.
Sources
- New trends in reports of imposter scams — Federal Trade Commission, 2026
- FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 — Federal Trade Commission, 2026
About the author
Cybersecurity & Digital Literacy
Subash Poudel builds SafeSurf IQ, a digital literacy platform that teaches people to recognise scams by putting them in front of real ones. He writes the online-safety reference material here, working from primary reporting — FBI IC3, the FTC, Verizon's DBIR, NCSC and Ofcom — rather than secondhand summaries.
- Founder and engineer, SafeSurf IQ
- Writes and reviews the platform's phishing, scam and privacy curriculum
- Works from primary incident and fraud reporting, cited on every article
Last reviewed . Figures are checked against the primary sources listed above at each review.
Read next
- Online Scams
Got an unpaid toll text? How to tell if it's real
A text demanding a few dollars for an unpaid toll, with a threat of late fees attached, is one of the highest-volume scams in circulation. Here is how to tell it's fake in seconds, and what to do if you already tapped the link.
- Phishing
What is phishing? How it works, and how to recognise it
Phishing is any attempt to trick you into handing over a credential, a payment or access by pretending to be someone you trust. The pretext changes constantly; the underlying request almost never does.
- Phishing
Someone called claiming to be my bank — is it real?
A call that says it's your bank, the police or tech support can feel completely convincing in the moment. Here is how to check without staying on the line - and why hanging up and calling back yourself is the only test that works.