A text about a package, account, or payment

Whatever problem the text describes, check it somewhere the text didn’t send you: the store’s order page, your bank’s app, a site you type in yourself.

If it’s happening now

You didn’t tap or reply. Report it and delete it (how). You’re done.

It says to reply Y, then reopen the text to “activate” the link. Don’t. An iPhone can switch off links from senders it doesn’t know. Replying switches them back on.

It’s about a delivery. Open the store’s order page, or type usps.com, ups.com, or fedex.com yourself and use the tracking number from your order email.

It’s about your bank or a charge. Don’t tap the link or call the number in it. Open your bank’s app, or call the number on the back of your card. Reply YES only if the text names a purchase you just made. If someone calls right after, hang up and dial the card number yourself. Someone says they’re from your bank.

It’s a toll, a DMV notice, or a fine. Check it on the agency’s site, typed in yourself. A text says you owe a toll or parking fine.

A stranger with the “wrong number” keeps chatting. Stop replying. Report it and delete it.

You’re on a page from the text, typing in your card. Close it. If a code from your bank arrives now, don’t type it anywhere. Call the number on your card.

What to say

• I typed my card number into a fake delivery page from a text. I need this card closed and a new one sent. Can I get a case number?

• The page asked for the code you texted me, and I typed it in. Can you check whether my card's been added to a phone or watch that isn't mine, and take it off?

If something already left your hands

Stop replying. Don’t delete the text yet. You’ll want a screenshot that shows the sender’s number.

You opened the link and typed nothing. Close the page. Don’t install anything it offers. If you’re still worried, check the account in its own app.

You started typing, then stopped before pressing Submit. Treat it as sent. These pages can grab what you type as you type it. Use the branch below for whatever you typed.

You typed a card number for a redelivery fee, a toll, or a customs charge. Call the number on the back of the card. Ask them to close it and send a new one. I paid with a credit or debit card.

Then a code from your bank arrived, and you typed it in. The page said the code would verify the payment. On these fake delivery and toll pages, it’s often the code that adds your card to the scammer’s Apple Pay or Google Wallet. Tell the bank, and ask them to remove the card from any phone or watch you didn’t add.

You typed a password. Change it in the real app or on a site you type in, then anywhere else you used it. If it was your bank password, call the number on your card too. Then add a second sign-in step: Lock down your accounts in 30 minutes. I gave out a code, password, or card number.

You typed your Social Security number. Freeze your credit at Equifax, Experian, and TransUnion. It’s free. Same page: I gave out a code, password, or card number.

You replied. There’s nothing to undo. They know the number works, so expect more texts. Don’t reply again, not even STOP. On an iPhone, Report Spam goes away once you’ve replied, so copy the text to 7726 instead.

You’ve been chatting with a “wrong number” for weeks, and now it’s about investing. Stop. An investment site that shows big gains but won’t let you withdraw unless you pay a fee first is the scam. An investment that can’t lose.

You sent money for a fee, a job, or an investment that started with a text. Call your bank or the payment company first. If it went by wire or crypto, also file at ic3.gov at the same time. Money you sent yourself may be treated as authorized and often isn’t paid back. Ask for a reversal, and for any denial in writing. I paid or sent money.

Then save the text (Save evidence without spiraling) and report it at ReportFraud.ftc.gov. Anyone who offers to get your money back for a fee is running a second scam, including people who say they’re with the FBI, IC3, the FTC, or a law firm. Someone offers to get my money back.

What it looks like

You ordered a lamp online on Monday. It's Thursday, and it hasn't come.

+1 (202) 555-0174

Text Message
Today 4:18 PM

USPS: Your package is on hold at our warehouse because the street address is incomplete. Please update your address within 12 hours or the package will be returned to the sender.
https://usps.com-parcelhold.top/us
(Please reply Y, then exit the text message and open it again to activate the link, or copy the link into your Safari browser.)
The USPS team wishes you a wonderful day.

You really are waiting on a package, and the link won't open. What do you do?

• Reply Y so the link works, then check that the page looks like USPS
• Copy the link into Safari, like the text says, so you don't have to reply
• Open the store's order page, or type usps.com yourself and use the tracking number from your order email

Show the answers

• Wrong move Reply Y so the link works, then check that the page looks like USPS The Y is what switches the link on. A page that looks like USPS proves nothing.
• Wrong move Copy the link into Safari, like the text says, so you don't have to reply It opens the same page. It will look like USPS. The address starts with usps.com, but the site is com-parcelhold.top.
• Best move Open the store's order page, or type usps.com yourself and use the tracking number from your order email A real address problem shows up there. USPS texts only people who signed up with a tracking number, and those texts don't contain links.

Expecting a package doesn't make the text real. Track it from your order email or a carrier site you type in yourself.

Saturday morning. A number you don't know.

+1 (415) 555-0163

Text Message
Today 10:52 AM

Hi Linda, it's Grace. Are we still on for lunch at Bellini's on Tuesday?

Sorry, wrong number.

Oh no, I'm so sorry to bother you. My friend must have given me the wrong number. You're very kind to answer. I'm Grace, I live in Seattle and work in art imports. Can I ask where you're from? Maybe we were meant to meet.

She's polite, there's no link, and she isn't asking for anything. What do you do?

• Tell her where you're from and chat a little. She isn't asking for anything
• Delete it and move on
• Don't reply again. Copy the text to 7726, then block the number

Show the answers

• Wrong move Tell her where you're from and chat a little. She isn't asking for anything The FTC says these chats turn into a friendship, often a romance, and then into investing on a site the texter picks. People report losing tens of thousands of dollars. The money comes up later.
• Okay Delete it and move on Fine, but she can text again, and your carrier never sees it.
• Best move Don't reply again. Copy the text to 7726, then block the number You've told her it's the wrong number. You don't owe her more. Because you replied, an iPhone won't offer Report Spam on this one, so 7726 is how you report it. Blocking stops this number.

A friendly stranger with no link and no ask can still be the start. Don't reply to unexpected texts. If you already said 'wrong number', stop there.

You're signing in to your pharmacy's app on a new phone. You just tapped Text me a code.

72914

Text Message
Today 2:06 PM

Mapleway Pharmacy: 604137 is your sign-in code. It expires in 10 minutes. Don't share this code. We'll never call or text to ask for it.

The text says not to share it. What do you do?

• Don't type it in. The text says not to share it
• Type it into the app you just opened
• Look up the pharmacy's texting number before you use it

Show the answers

• Wrong move Don't type it in. The text says not to share it Then you can't sign in. Typing it into the app you opened isn't sharing it. Sharing is reading it to a caller, texting it back, or typing it into a page a message sent you to.
• Best move Type it into the app you just opened You asked for it seconds ago, in an app you opened yourself. That's what the code is for.
• Okay Look up the pharmacy's texting number before you use it Harmless, but it isn't what makes this safe. You asked for the code, and you're typing it where you asked.

A code you asked for goes into the app or site you opened. A code you didn't ask for can mean someone is trying to get into that account: don't share it, and change that password.

What they’ll ask for

“Reply Y, then exit and reopen this message to activate the link.” Don’t reply. That’s what turns the link on.

“Your package is on hold. Update your address within 12 hours.” Or a small “redelivery fee.” Track it from your order email. USPS texts only people who signed up with a tracking number (texting it to 28777, for example), and USPS texts don’t contain links.

“Import duties are due on your package.” This one can be real. FedEx says it may text or email a link to pay duties and taxes on international packages. Don’t pay from the text. Go to fedex.com yourself, search for FedEx Import Tool, and sign in with the email or phone number the package was sent to. The code it sends you is one you asked for. If anything is owed, it’s listed there.

“Enter the code your bank just sent to confirm the payment.” Stop there. That code can put your card on the scammer’s phone. Call the number on your card.

“Did you make a $1,249.00 purchase? Reply YES or NO.” If you just made that purchase, replying YES is fine. It can’t move money. If you didn’t, don’t reply. Check your bank’s app or call the number on your card, and do the same if a call or a request for a code follows. The FTC says replies to fake ones lead to a fake fraud department that tells you to move your money to keep it safe. No bank asks you to move money to protect it.

“Hi Linda, are we still on for lunch Tuesday?” Not you. Don’t reply. If you already said “wrong number,” stop there.

“Mom, I dropped my phone. This is my new number.” Call the old number, or someone who’s with them. Someone claiming to be family needs money.

“Flexible remote work, about an hour a day. Interested?” The FTC calls these task scams: you rate products or apps, then you’re told to pay to finish the tasks or withdraw your earnings. People who paid didn’t get it back. A job offer that seems too easy.

How to report a text

If anything left your hands, screenshot the text first. Reporting can delete it.

iPhone. Open the text and tap Report Spam at the bottom (Report Junk on iOS 18 and earlier), then Delete and Report Spam. No Report Spam? You’ve replied to it, or your carrier doesn’t offer it. Use 7726.

Android, in Google Messages. Touch and hold the conversation, tap Block, then Report spam, then OK.

Any phone. Copy the text and send it to 7726 (SPAM). Your carrier uses it to block similar texts. It may text back asking which number it came from. Reply with that number.

Fake USPS texts can also go to [email protected], and fake FedEx ones to [email protected]. If you lost money or typed in anything, also report it at ReportFraud.ftc.gov.

What not to waste time on

Working out whether the sender looks real. A text that uses your name, or lands the week you’re waiting on a package, proves nothing.