Text Message Scams: Spot Fake Alerts, Messages, and QR Code Scams

Text message scams are becoming increasingly common, and they're often designed to look legitimate.

A message may appear to come from your financial institution, a package delivery company, a government agency, or a well-known retailer. The goal is to create a sense of urgency and convince you to click a link, scan a QR code, call a phone number, or share personal information.

These scams, often called "smishing" (SMS phishing), can lead to account takeovers, identity theft, financial loss, and stolen personal information.

Understanding how they work can help you avoid becoming a victim.

What Is a Smishing Scam?

Smishing is a type of phishing scam delivered through text messages.

The message usually creates concern, curiosity, or urgency and encourages you to take immediate action.

Examples include:

• A fraud alert claiming your debit card has been locked
• A notice that your account has been suspended
• A package delivery problem requiring immediate action
• An unpaid toll or traffic fee
• A warning that your account has been compromised
• A request to verify personal information

The message often includes a link, phone number, or QR code designed to capture your information.

Fake Fraud Alert Text Messages

One of the most common scams impersonates a financial institution.

You may receive a text claiming there is suspicious activity on your account or card and asking you to verify a transaction.

The message may instruct you to:

• Click a link
• Call a phone number
• Reply with personal information
• Enter account credentials on a website

The text may even include the name of a real financial institution.

Remember: scammers can easily impersonate trusted organizations.

If you receive an unexpected fraud alert, contact your financial institution using a phone number you know is legitimate rather than responding to the message.

Account Suspension Scams

Another common tactic is claiming your account has been locked, suspended, or restricted.

The message may state:

• Your Online Banking account has been disabled.
• Unusual activity has been detected.
• Immediate verification is required.
• Your account will be closed unless you act now.

The scammer hopes you'll panic and click the link without verifying the message.

Legitimate organizations generally provide multiple ways to communicate important account issues and do not rely solely on threatening text messages demanding immediate action.

If you're concerned about an account, log in through your normal website or mobile app rather than using a link from a text message.

Delivery and Package Tracking Scams

Package delivery scams have become especially common as online shopping has increased.

You may receive a text claiming:

• A package could not be delivered.
• Additional shipping fees are required.
• Your address needs verification.
• A package is waiting for pickup.

The message usually contains a link to a fake website that attempts to collect personal information, payment card details, or account credentials.

Even if you're expecting a package, don't assume the message is legitimate.

Instead, visit the delivery company's website directly or use its official mobile app to check shipment status.

The Growing Risk of QR Code Scams

Scammers are increasingly using fraudulent QR codes to direct people to fake websites.

Known as "quishing" scams, these attacks work similarly to phishing emails and text messages.

A scammer may place a QR code in:

• Text messages
• Emails
• Flyers
• Parking meters
• Public bulletin boards
• Fake invoices
• Social media posts

When scanned, the QR code may direct you to a fraudulent website designed to steal:

• Login credentials
• Credit card information
• Personal information
• Verification codes

Always take a moment to review the website address before entering any information after scanning a QR code.

Common Warning Signs

Many text message scams share the same red flags.

Be cautious if a message:

• Creates a sense of urgency or panic
• Threatens account suspension
• Requests personal or financial information
• Includes an unexpected link
• Contains spelling, grammar, or formatting errors
• Asks you to log in through a provided link
• Requests verification codes
• Prompts you to scan a QR code to fix a problem

If something feels suspicious, trust your instincts and verify the message independently.

How to Protect Yourself

A few simple habits can help reduce your risk.

• Do not click links in unexpected text messages.
• Do not scan QR codes from unknown or untrusted sources.
• Do not share passwords or verification codes.
• Access financial accounts through official apps or websites you type yourself.
• Verify package deliveries through the carrier's official website.
• Keep your device and security software updated.
• Contact organizations directly using trusted contact information if you have concerns.

Taking a few extra moments to verify a message is often enough to avoid a scam.

What To Do If You Clicked a Link or Shared Information

If you interacted with a suspicious message:

1. Stop communicating with the sender.
2. Change any passwords you may have entered.
3. Update passwords for other accounts using the same credentials.
4. Contact your financial institution if account or card information was shared.
5. Review your accounts for unauthorized activity.
6. Monitor your credit and identity for signs of fraud.
7. Report the scam through the FTC Fraud Reporting Portal.

Acting quickly can help reduce potential damage.

Think Before You Tap

Text messages feel personal and immediate, which is exactly why scammers use them.

Whether the message claims your account is locked, your package is delayed, or your identity is at risk, the goal is usually the same: get you to act before you think.

When in doubt, don't click.

Instead, contact the company, financial institution, or organization directly using a phone number or website you know is legitimate.

A few moments of verification can prevent a costly mistake.