A text lands on your phone warning of an unpaid toll, a stuck package, or suspicious activity on your bank account. It pushes you to tap a link or call a number right now. Something feels off, and you are right to pause.
Scam texts (often called smishing, a blend of SMS and phishing) are designed to make you act before you think. The good news: spotting them follows a short checklist, and reporting them takes seconds once you know the exact taps.
This guide walks you through how to recognize a scam text, what to do the instant one arrives, and how to report and block it on iPhone, Android, and through your carrier and the right agencies. Work top to bottom; the quickest, most universal moves come first.
Recognize the Red Flags Before You Tap Anything
Most scam texts share the same tells. If you see one or more of these, treat the message as fraudulent.
It claims there is a problem with your account or payment info, or reports suspicious activity you did not trigger.
It sends a fake invoice and tells you to call if you did not authorize the charge.
It promises free prizes, gift cards, or coupons.
It says your account is on hold over a billing problem and to click a link to update payment details.
It uses a generic greeting instead of your name.
Your wireless carrier names five practical signs: the message has no relevance to you; it is urgent or demands immediate action; it contains misspellings or poor grammar; it comes from a strange phone number or odd email address; and it contains a suspicious link.
Remember the core principle from the FTC: legitimate companies will not unexpectedly text you a link to update your payment or account information.
Know the Impersonation Tells (IRS, Delivery, Bank, Toll)
Scammers reuse a handful of disguises. Each has a clean giveaway.
Government / IRS: Agencies almost never start contact by text. The IRS states plainly that it does not send text messages without your permission and does not initiate contact by text, email, or social media. Scam IRS texts use alarming lines like "Your account has now been put on hold" with a bogus "Solutions" link.
Delivery / USPS: The Postal Inspection Service confirms USPS will not send a text or email without you first requesting the service with a tracking number, and that message will not contain a link. Any USPS text with a link that you never signed up for is fake. Watch also for a delivery-problem notice when you never made a tracking request, awkward grammar, a payment or info request, and a missing tracking number.
Bank: Wells Fargo confirms its employees will not contact you to ask for your PIN, password, or one-time access codes, and will never ask you to send money to reverse a transfer, get a refund, or "protect" your money. By the same logic, an alert about an account you do not even hold is a clear warning sign.
Toll: The FBI documented texts like "We've noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit [a look-alike link] to settle your balance." The pattern is a claimed unpaid toll, a threatened late fee, and a link to a fake site. A real-looking URL is not proof it is genuine.
Do Not Reply, Click, or Open Attachments
Every official source agrees on the first move: do nothing the text asks. The IRS puts it directly: do not reply, click links, or open attachments. Do not respond to texts from unknown numbers, and never share personal or financial information by text.
On iPhone this matters for a second reason: you cannot report a message after you have replied to it, so report or block before you respond.
Verify Through a Channel You Trust
If the text claims to be your bank, carrier, or a delivery service, confirm independently. Contact the company using a number or website you know is real, not the contact info in the text.
Use the phone number on the back of your card, your printed bill, or the official website or app you already use.
For a delivery text, look up the tracking number directly on the carrier's official site instead of the link.
For a bank alert, Wells Fargo points customers to the number on the card, the official site, or the bank's mobile app.
If you want to keep the message as evidence for a report, screenshot it now, because some reporting methods delete it permanently.
Forward the Text to 7726 (SPAM)
This is the single most universal report and it is free. Forwarding to 7726 helps your wireless provider spot and block similar messages.
- 1.Open the scam message and copy or forward its contents to 7726 (which spells SPAM).
- 2.On many phones you long-press the message bubble, choose Forward, type 7726 in the To field, and send.
- 3.Your carrier may text back asking for the originating phone number. Reply with that number; the carrier uses it to update its filters and block the sender.
That follow-up reply is easy to ignore, but skipping it leaves your report incomplete. Send the number when asked.
Report and Delete It on iPhone
Apple's current iOS 26 Messages flow uses "Report Spam." If you instead see "Report Junk," you are on an older iOS version.
If you have not opened the message, swipe left on it, tap the icon, then tap Delete and Report Spam.
If you have already opened it, tap the Report Spam link at the bottom of any message from an unknown sender, then tap Delete and Report Spam.
Two things to know. You cannot report a message once you have replied to it. And for iMessages, reporting sends the info to Apple and permanently deletes the message from your iPhone, so screenshot first if you need a record. Reporting spam does not block the sender, which is a separate step below.
Block the Sender on iPhone
Blocking stops future messages from that number, and the sender is not told they are blocked.
In the conversation, tap the name or number at the top.
Tap Info and scroll down.
Tap "Block this Caller" and confirm.
Because reporting and blocking are independent actions on iPhone, do both for a scam text.
Turn On Screen Unknown Senders (iPhone)
This native filter quietly routes texts from people not in your contacts away from your main inbox.
Go to Settings > Apps > Messages > Unknown Senders.
Turn on Screen Unknown Senders.
Messages from non-contacts then land in an "Unknown Senders" tab with no notifications or badges, and iOS 26 also auto-routes suspected spam to a "Spam" tab. The setting is off by default on a fresh iOS 26 setup, but it turns on automatically if you upgraded from iOS 18 with the older "Filter Unknown Senders" option enabled.
One trade-off: a legitimate verification code or order update can get filtered silently. To rescue one, open the conversation and tap "Mark as Known" from Unknown Senders, or "Not Spam" from the Spam tab. You can also separately allow alerts for Time Sensitive, Personal, Transactions, and Promotions message types.
Report or Block on Android (Google Messages)
Google Messages lets you report, block, or both.
From the conversation list, touch and hold the conversation, tap Block, tap "Report spam," then tap OK.
Or inside an open conversation, tap More options, tap Details, tap "Block & report spam," then tap OK.
You can report spam without blocking if you prefer. When you report, Google receives the sender's phone number plus a copy of the last 10 incoming messages from that sender; your own past replies are not sent. Reported or blocked threads move to the "Spam & blocked" folder. Because that last-10-messages copy goes to Google, do not "report" a real but unsaved contact just to clear sensitive content.
Turn On Spam Protection (Android)
This setting uses on-device machine learning to catch known spam patterns and hide suspected spam in a spam folder.
Open Google Messages and tap your profile picture or initials in the top right.
Tap "Messages settings."
Tap "Spam protection."
Turn "Enable spam protection" on.
It also checks links by uploading URLs to Google to confirm they are not malicious. Note that "Spam protection" only appears if it is available on your device.
Report It to the Right Agency
Forwarding to 7726 trains your carrier; reporting to an agency feeds enforcement. Pick the ones that fit.
FTC: File at ReportFraud.ftc.gov. If a scammer obtained your Social Security number, card, or bank account number, go to IdentityTheft.gov for tailored recovery steps.
FCC: File a consumer complaint at no cost. If you believe you are a victim, also contact law enforcement.
FBI (IC3): File at ic3.gov, especially if you lost money or clicked. Include the phone number the text came from and the link it listed. Type www.ic3.gov directly into the address bar and confirm it ends in .gov, because scammers spoof the IC3 portal. Victims aged 60 and older who need help filing can call the DOJ Elder Justice Hotline at 1-833-372-8311.
Report Impersonation to the Spoofed Brand
The agency or company being faked wants these reports too.
IRS texts: Email the sender's number, the message contents, your number, and the date, time, and time zone received to [email protected] with the subject line "Text." Also forward to 7726.
USPS texts: Without clicking the link, copy the message body into a new email, include your name and a screenshot showing the sender's number and date, and send to [email protected]. Also forward to 7726. If you interacted with the link at all, notify your bank and report to ReportFraud.ftc.gov and ic3.gov.
UPS / FedEx texts: Forward to [email protected] or [email protected].
Bank texts: If you handed over codes or account info, call your bank immediately using the number on the back of your card. For Wells Fargo, that line is 1-800-869-3557.
If You Already Clicked, Replied, or Paid
Act quickly to limit the damage.
Contact your carrier to help secure your account, and reach out to any bank or service that may be affected.
If you may have installed malware by tapping a link or opening an attachment, update your device's security software, run a scan, and remove anything it flags.
If a scammer has identifying info such as your SSN, card, or bank account, go to IdentityTheft.gov for tailored recovery steps.
Dispute any unfamiliar charges with your bank or card issuer, and report the loss to ic3.gov.
Once you have reported the message, delete it.
Frequently Asked Questions
Does reporting a spam text on my iPhone also block the sender?
No. On iPhone, reporting and blocking are two separate actions. Reporting spam does not stop future messages from that number; to do that, open the conversation, tap the name at the top, tap Info, and tap "Block this Caller." For full protection, do both.
I forwarded a text to 7726 and got a reply asking for a number. What now?
Reply with the originating phone number the scam text came from. Your carrier uses that number to update its filters and block the sender. If you ignore this reply, your report stays incomplete.
How can I tell a fake USPS delivery text from a real one?
USPS will not send you a text or email unless you first requested the service with a tracking number, and that message will not contain a link. So any USPS text with a link that you never signed up for is fake. When in doubt, check the tracking number on the carrier's official site, not the link in the text.
Would my bank ever text me asking for a code or to move money?
No. A bank will not ask by text for your PIN, password, or one-time access code, and will never tell you to send money to reverse a transfer, get a refund, or "protect" your funds. An alert about an account you do not hold is a clear warning sign. Verify by calling the number on the back of your card.
I saw "Report Junk" instead of "Report Spam" on my iPhone. Is that wrong?
It just means you are on an older version of iOS. The current iOS 26 flow uses "Report Spam" and "Delete and Report Spam." Earlier versions used "Report Junk." The steps are equivalent: swipe left on an unopened message, or tap the link at the bottom of an opened one, then confirm.
Is it safe to report a text from a real person who just is not in my contacts?
Be careful on Android. When you report spam in Google Messages, Google receives the sender's number and a copy of the last 10 incoming messages from them. That is fine for actual spam, but if a real but unsaved contact sent something sensitive, block them instead of reporting, so that content is not shared.