A fake text message is a deceptive SMS made to look like it comes from a trusted bank, delivery company, government agency, or brand. Some create a false sense of urgency; others copy a familiar sender name or appear inside an existing message thread. According to the FTC, consumers reported losing $470 million to scams that started with text messages in 2024—about five times the amount reported in 2020.
No single sign proves a text is fake. Use a quick cluster check: who the message claims to be from, what it asks you to do, and how hard it pressures you. The golden rule is simple: do not reply and do not click; verify through a channel you already know is genuine.
This guide explains how to check a suspicious text, what to do if you interacted with one, and how legitimate businesses can make their own messages easier to trust.
What a fake text message is (and what smishing means)
“Fake text message” is the everyday term. The security industry calls it smishing, short for SMS phishing. Four terms are worth separating:
| Term | What it means |
| Fake text message | A deceptive text impersonating a trusted sender to make you act |
| Smishing | Phishing delivered by SMS; the security-industry name for these scams |
| Sender ID spoofing | Making a text appear to come from a name or number that is not the real sender; a sender ID is a label, not proof |
| Spam | Unsolicited or unwanted marketing; annoying, but not necessarily deceptive |
A single message can fit more than one category. For example, a smishing message may use sender ID spoofing and may also be sent in bulk.
The spam-versus-scam distinction matters because the response differs. For unwanted marketing from a legitimate business, use the sender’s stated opt-out method. For a suspected scam, do not engage. This is orientation, not legal advice.
Research from University College London divides SMS scams into two broad types: conversational scams that talk the victim into authorizing a payment, and URL-based scams that lead to credential theft, malware, or unauthorized fraud.
Sending business SMS? See what carriers block in our guide to spam text message examples businesses must avoid.
The signs of a fake text message
The reliable signs fall into five clusters, drawn from FTC guidance: unexpected contact; pressure or threats; a shortened or lookalike link or number to call; a request for personal, financial, or login details or payment; or an offer that seems too good to be true. No single signal is proof. Read them as a cluster, then use this routine:
- Pause. A text demanding action within minutes earns a slower look, not a faster one.
- Inspect the sender and context. Were you expecting anything from this sender? A delivery text when you ordered nothing, or a security alert from a bank you do not use, fails the context test.
- Inspect the request. Does it want a click, call, payment, or your information? Legitimate businesses may ask customers to reply, but they should not ask recipients to disclose passwords, full payment-card details, or one-time security codes by text.
- Verify off-channel. If the claim could be real, check it through a number, app, or website you already know is genuine, never the contact details in the message.
Two mechanics most checklists miss:
- A fake can sit inside a genuine thread. Phones group messages by sender ID, so a spoofed ID can put a scam inside the organization’s real thread. Being in the right thread is not proof.
- You cannot hover an SMS link. Unlike desktop email, an SMS inbox does not preview the destination. Treat links in unexpected texts as unverified.
Poor spelling is no longer a dependable warning sign. The Australian Government’s 2024 impact analysis notes that generative AI can help scammers produce cleaner, more convincing copy. Verify the request and destination rather than relying on grammar alone.
The signals, from both sides:
| Signal | What a recipient checks | What a legitimate sender controls |
| Sender identity | Is the sender name or number expected, or unknown and generic? | Sends from a consistent, registered sender ID |
| Message context | Does the text reference something you actually did? | Triggers messages from real customer events and states the context |
| Link behavior | Is there a link, especially a shortened or lookalike domain? | Uses a stable branded domain instead of generic shorteners |
| Request type | Does it ask for sensitive data, login details, or payment? | Does not ask recipients to reply with or disclose sensitive information by text |
| Tone and urgency | Does it pressure immediate action or threaten consequences? | Communicates urgency through facts, not threats |
The recipient column is the recognition routine. The sender column becomes the design brief for legitimate business messages later in this guide.
The most common fake text patterns
Regulator and consumer-body guidance keeps surfacing six lure families. This list is illustrative, not exhaustive:
- Package delivery problems. A parcel could not be delivered, and a small redelivery fee or address update is needed via the link.
- Unpaid tolls. You owe a road toll and must pay now to avoid penalties.
- Fake fraud or bank security alerts. Suspicious activity was detected on your account, and you must verify it immediately.
- Prizes and refunds. You have won a gift card, or a refund is waiting; confirm your details to claim it.
- Phony job offers. Easy remote work with high weekly pay; reply to start.
- “Wrong number” conversation hooks. A friendly, seemingly misdirected message that tries to keep you chatting.
Each illustration is a de-identified composite of the pattern, not a real message.
An FTC finding shows bank impersonation was the most-reported scam arriving by text in the US in 2022, with reports up nearly twentyfold since 2019. That historical US finding is why fake bank alerts deserve a prominent place in the checklist.
Although the details vary, these scams use the same basic tactic: create urgency and direct you to a link, phone number, or reply channel. The four-step check above can help you evaluate each one.
What to do when you receive a fake text
When a text fails the signal check, work through four actions in order:
- Do not engage. Do not reply, click links, call a number, or use an opt-out instruction in a suspected scam. Opt-out methods are for messages from legitimate senders.
- Verify off-channel. If the claim might be real, contact the organization through a number, app, or website you already know is genuine, never the contact details in the message.
- Report it. In the US, forward the text to 7726 (SPAM) and report it at ReportFraud.ftc.gov. In the UK, suspicious texts can also be forwarded to 7726 through participating providers, as explained by the NCSC. Tax-themed fakes can be reported to the IRS. Reporting options vary by country and carrier, so check the official guidance where you live.
- Delete the message. Once reported, remove it to prevent an accidental tap.
Reporting gives mobile providers and security teams additional signals they can use to investigate and disrupt scam campaigns.
Even a perfect routine has one blind spot: sometimes the sender name itself is the fake part. Here is how that happens, and what is being done about it.
Why a fake text can look real: the sender-identity gap
How can a scam text display your bank’s actual name? On some SMS routes, the sender ID is a label the sender can set, not a verified identity. Phones group messages by that label, so a spoofed ID can enter a genuine thread. In one case cited in the Australian Government’s 2024 impact analysis, a bank impersonation text landed inside the victim’s real bank thread. Thread placement is not proof.
Several jurisdictions are narrowing the gap through sender ID registries. Depending on the regime, unregistered IDs may be labeled, blocked, or left outside a voluntary register. These systems can reduce unauthorized use of protected sender names, but they do not prove that every message under a familiar name is safe.
| Jurisdiction | Regime | Key dates |
| Singapore | Full SMS Sender ID Registry regime: registration required; unregistered IDs are marked “Likely-SCAM” | In force since 31 January 2023 |
| Finland | Voluntary sender ID register | November 2023 |
| Hong Kong | SMS sender ID registration scheme | December 2023 |
| Australia | ACMA sender ID register pilot; legislation passed in 2024 | Pilot launched 15 December 2023 |
| Ireland | ComReg SMS Sender ID Registry: “Likely Scam” labels apply to unregistered IDs, with blocking planned | Launched in June 2025; labeling began in July 2025 |
Registry rules differ by country. Registries reduce impersonation but do not eliminate it: lookalike IDs and message-body impersonation can still get through. The labels also cut both ways: a “Likely Scam” label may be applied when a legitimate business has not registered. Separately, Australian telcos reported blocking more than 668.3 million scam SMS between July 2022 and June 2024. For the carrier-side view, see SMS filtering.
If unregistered senders now get labeled or blocked, the sender-side question becomes urgent: how does a real business stay verifiable?
How legitimate businesses prove their texts are real
How do you keep your real messages from looking fake? Flip the recipient checklist into design rules: practical guidance distilled from FTC recognition advice, CTIA consent principles, and carrier documentation, not a regulator quote.
- Send from a consistent, registered sender identity. In the US, application-to-person messages sent to US recipients from 10-digit long-code numbers generally require A2P 10DLC brand and campaign registration. Unregistered traffic may be filtered or blocked, depending on the provider and carrier path. Other countries use different sender-identity frameworks, so registration is a per-market decision.
- Put your brand name in the message body.
- Use a stable branded domain instead of generic link shorteners.
- Do not ask recipients to reply with or disclose sensitive data by text. This includes passwords, full card numbers, and one-time codes.
- Avoid pressure tactics. Communicate urgency through facts, not threats.
- Match something the customer expects. Messages triggered by the customer’s own action, like event-driven transactional SMS, arrive with context the recipient already recognizes.
The stakes are measurable. Survey findings reported in the Australian impact analysis, from a Deloitte Access Economics Australia-specific sample, found that 31% of sender ID users experienced customer disengagement due to scams, 84% of consumers agreed scam texts reduced their trust in the channel, and 95% changed their behavior as a result. Distrust has become a deliverability factor, not just a brand problem.
Even verification codes are a phishing target. SMS-based MFA is safer than relying on a password alone, but it is not phishing-resistant. CISA’s December 2024 guidance recommends that highly targeted users and valuable accounts migrate to phishing-resistant authentication such as FIDO where feasible. Every message type still needs a verifiable sender identity.
For depth, see our SMS compliance and deliverability guide and our guide to writing business texts customers actually read.
If scammers impersonate your brand: first moves
Good design prevents confusion, but it cannot stop a determined impersonator. If scammers use your sender identity, start with these steps from registry and security-vendor guidance. This is practical advice, not legal advice:
- Collect samples and customer reports. Screenshots, dates, and the numbers or sender IDs used; every later step needs them.
- Notify your messaging provider or aggregator. Registry guidance directs businesses to engage their aggregator to investigate spoofed sender IDs. Your provider can also tell you whether your own messages are getting flagged as a side effect.
- Warn customers through your official channels. Your website, app, email, and social accounts should carry a clear description of the fake and of what you will never ask for.
- Report to the relevant registry or authorities in each affected country.
- Harden sender identity and keep monitoring. Register your sender IDs, keep templates consistent, and watch for new waves.
One scope note: registry protection can be jurisdiction-limited. SGNIC notes that Singapore’s whitelisting applies to Singapore mobile numbers, so recipients abroad may still receive spoofed texts. No provider can promise to stop impersonation entirely. The goal is to make the real you easy to verify and the fake easy to report.
Sending texts customers can trust: the next step
Every check in this guide comes down to the same signal set: a verifiable sender identity, expected context, clean links, and no pressure. Recipients use those signals to judge a text; businesses control them.
A trustworthy business message starts before it is sent. The sender identity, destination rules, message wording, opt-out process, and reporting setup all affect how recipients and mobile networks treat it. Our team helps businesses configure sender identities, API-based messaging, and delivery reporting for OTPs, notifications, and customer communication. Because sender rules vary by country and use case, the destination, traffic type, and reply requirements should be confirmed before launch.
Planning a business SMS program? Share your target countries, message type, expected volume, and preferred sender identity when you contact our messaging team. We can help you review the available setup before testing.
FAQ
Is a text from an unknown number automatically fake?
No. Judge the signal cluster, not one trait. Some legitimate services text from numbers you have not saved, so combine the sender with context, request type, and urgency.
Should I reply STOP to a scam text?
No. Do not engage with a suspected scam; report it instead. For a message from a legitimate business, follow its stated opt-out method.
Can a scam text use a real company’s name or appear in my real message thread?
Yes. Phones group messages by sender ID, so a spoofed sender ID can place a scam text inside a genuine thread; placement is not proof.
Does a registered sender ID guarantee a message is safe?
No. Registries reduce impersonation, but lookalike unregistered sender IDs and message-body impersonation still get through. Keep applying the signal check even to named senders.
Can my legitimate business messages be labeled “Likely Scam”?
Yes. In registry countries, unregistered sender IDs can be labeled even when the sender is legitimate, which is why sender registration belongs in your sending setup.
