A suspicious text or email: is it a scam?

Scam texts and emails (called phishing) try to get you to click a link, pay a fake bill, or type in a password or account number. Here’s how to spot them and what to do.

Is this a scam? Quick signs

• It’s urgent or scary. CISA (the U.S. Cybersecurity and Infrastructure Security Agency) says to watch for messages that claim something bad will happen if you don’t respond right away.
• It asks for personal or financial information, or for you to “confirm” your account. The FTC says legitimate companies won’t ask for information about your account by text.
• It wants you to click a link to pay or update your payment details. The FTC says legitimate companies won’t email or text you a link to update your payment information.
• The link or sender looks a little off, like amazan.com, or it’s a shortened link you can’t read (CISA).
• It’s an invoice you don’t recognize, a “suspicious login” warning, a government refund, or a free coupon (FTC).
• Perfect spelling doesn’t mean it’s safe. CISA says bad grammar used to be a clue, but with AI some scam emails now have perfect grammar and spelling.

Common scam messages

• “Your package can’t be delivered.” The U.S. Postal Inspection Service says if you never signed up for USPS tracking for a specific package, don’t click the link. It’s a text scam called smishing.
• “You owe an unpaid toll.” The FCC warns about fake texts claiming to be from toll companies that say your account will be suspended unless you pay right away. The FTC says don’t click; check with the state’s tolling agency using a phone number or website you know is real.
• “Suspicious activity on your account.” The FTC says scammers claim they’ve noticed suspicious activity when they haven’t. Call the number on the back of your card instead.
• “This is the IRS” or “Social Security.” The IRS says it doesn’t make first contact through email or social media, and sends texts only if you opted in. Social Security says it will never ask for sensitive information by email, text, or social media.
• “Your computer is infected, call this number.” See tech support scams on our phone calls page.

Do this right now

1. Don’t click any link or open any attachment. Don’t call a number in the message.
2. Don’t reply. CISA says don’t reply or click any link, including any “unsubscribe” link.
3. If you think it might be real, check another way. Type the company’s website address yourself, or call a number from your bill, your card, or the company’s real website.
4. Report it (see below), then delete it.

If you clicked, replied, or paid

• You typed a password: the FTC says to create a new, strong password for that account (and anywhere else you used the same one), and turn on two-step verification. Locked out? See what to do if an account is hacked.
• You gave a card or bank number, or paid: call your bank or card company now. See I already paid.
• You gave your Social Security number: go to our identity theft guide.
• You let someone into your computer, or downloaded something: the FTC says to update your security software, run a scan, delete anything it flags, and change your passwords.

How to report a scam text or email

• Forward scam texts to 7726 (it spells SPAM). The FTC says this helps your wireless provider spot and block similar messages.
• Use the “report junk” or “report spam” option in your messaging app or email.
• Tell the FTC at ReportFraud.ftc.gov.
• Fake USPS texts: the Postal Inspection Service asks you to email [email protected]. Without clicking the link, copy the text into the email, add your name, and attach a screenshot showing the sender’s number and the date.

Get fewer scam texts

The FTC says your phone may have an option to filter and block messages from unknown senders, and your wireless provider might have a tool or service to block texts. Ask your phone company what it offers.

Sources

Last checked Oct 18, 2026.

1. FTC: How to Recognize and Report Spam Text Messages: https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages
2. FTC: How To Recognize and Avoid Phishing Scams: https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
3. FTC: Got a text about unpaid tolls? It's probably a scam: https://consumer.ftc.gov/consumer-alerts/2025/01/got-text-about-unpaid-tolls-its-probably-scam
4. FTC: What To Do if You Were Scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
5. FCC: How to Spot and Avoid Toll Road Payment Scam Texts: https://www.fcc.gov/consumer-governmental-affairs/how-spot-and-avoid-toll-road-payment-scam-texts
6. CISA Secure Our World: Recognize and Report Phishing: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
7. U.S. Postal Inspection Service: Smishing (package tracking text scams): https://www.uspis.gov/news/scam-article/smishing
8. IRS: Ways to tell if the IRS is reaching out or if it's a scammer: https://www.irs.gov/newsroom/ways-to-tell-if-the-irs-is-reaching-out-or-if-its-a-scammer
9. Social Security Administration and OIG: Protect Yourself from Scams: https://www.ssa.gov/scam/

Rules and numbers change. If something here does not match what an agency tells you, trust the agency, and please let us know.