AI Text Message Scams: How to Spot a Fake Text Before You Click, Reply, or Pay

Text message scams can look polished, specific, and surprisingly believable. A fake package notice may know your city. A bank alert may sound professional. A bogus job opportunity may use natural language with no obvious spelling mistakes. Generative AI can also help criminals produce believable text faster and reduce some of the errors that once made scams easier to recognize.

The safest response is therefore not to ask, “Does this text look fake?” Instead, ask: Can I verify the sender and the requested action without using anything inside this message?

This guide shows you how to check suspicious text message scams, understand where AI changes the warning signs, verify common package, bank, toll, job, and wrong-number texts, and respond safely if you already clicked, replied, shared information, or paid.

Last reviewed: August 10, 2026 · General educational fraud-prevention guidance

1. Check Suspicious Text Messages With the TEXT Test

The TEXT test is a simple decision process for suspicious SMS or messaging requests. It is not a score where several reassuring clues make a message “safe.” Its purpose is to move verification outside the message before the sender controls what you click, call, share, or pay.

T — Tell What the Text Wants You to Do

First, strip away the story and identify the requested action. A message may talk about a package, suspicious charge, refund, court notice, job opening, loan application, account lock, or family emergency, but the important part is what it wants you to do next.

Pause if an unexpected message asks you to:

• click a link or scan a QR code,
• reply YES, NO, STOP, or another word,
• call the number contained in the text,
• log in or “verify” an account,
• send a password or one-time verification code,
• provide a Social Security number or other identity information,
• enter card or bank information,
• pay a fee, fine, toll, deposit, or invoice,
• buy gift cards or send cryptocurrency,
• download an app or file, or
• move the conversation to another messaging platform.

E — Examine the Claim

Ask what real-world event the sender claims happened. Do you actually have a package on the way? Did you apply for that job or loan? Does your independently opened banking app show the transaction? Do you recognize the person through an existing conversation?

A claim that sounds plausible is not evidence that the message is authentic. Scammers often choose situations that are common enough to fit a large number of people.

X — eXit the Message

This is the most important step. Do not use the suspicious message to authenticate itself. A scam text can provide a fake website, fake support number, fake payment page, fake tracking portal, or another scammer who pretends to confirm the original story.

Close the text and start verification somewhere else.

T — Trust a Separate Channel

Use a contact route you already trust. That could mean opening the genuine banking app already installed on your phone, checking a retailer account directly, using the number printed on the back of your payment card, visiting a government website independently, or contacting someone through a saved number or existing conversation.

T — Tell what the message wants me to do.
E — Examine what it claims happened.
X — Exit the message. Do not use its links, numbers, QR codes, or reply route.
T — Trust a separate channel I independently know is real.

If it asks for a password, one-time code, payment, financial details, identity information, download, or account access, stop and verify before acting.

2. Why AI Text Message Scams Can Look Completely Real

Older scam advice often focused heavily on bad grammar, strange wording, and obvious spelling mistakes. Those clues can still matter, but they are no longer reliable proof by themselves.

The FBI has warned that criminals use AI-generated text in social engineering and financial fraud. Generative AI can help create believable messages more quickly, translate them, and reduce grammatical or spelling mistakes that might otherwise reveal a scam.

That does not mean every polished scam message was generated by AI, and it does not mean every awkward message is fraudulent. You usually cannot determine from the writing alone whether AI was used.

The FBI has also documented malicious messaging campaigns in which attackers start with SMS, build trust, move the conversation to another platform, request authentication codes, or attempt to gain access to accounts. That makes the behavior of the request more useful than judging whether the writing “sounds like a scam.”

Weak Reasoning

“The message uses my name, the grammar is perfect, and it sounds like a real delivery notice, so it is probably safe.”

Stronger Verification

“I ignored the message link and opened my retailer or carrier account independently. There is no delivery problem there, so I will not act through the text.”

3. Which Text Scam Warning Signs Matter Most?

A single typo is weaker evidence than an unexpected request that exposes your money or account. Use the risk level of the requested action—not just the appearance of the text—to decide how cautious to be.

High-Risk Combinations

• An unexpected text plus a login or payment link.
• A bank “fraud alert” plus a phone number you are told to call immediately.
• A package problem plus a small “redelivery fee.”
• A toll warning plus threats of penalties or legal consequences.
• A recruiter plus upfront fees, banking information, identity documents, or equipment payments.
• A familiar person plus a new number and an urgent request for money or codes.
• A friendly wrong-number conversation that quickly turns personal, romantic, financial, or investment-related.
• A request to move to another messaging platform before the sender has been independently verified.

4. What Kind of Text Did You Receive?

FTC reporting shows that frequently reported text-message scams include fake package-delivery notices, bogus job opportunities, fake fraud alerts, unpaid toll warnings, and wrong-number approaches. The safest verification method depends on the story the text is using.

Fake Package Delivery Texts

A package text may claim that delivery failed, your address is incomplete, postage is due, or you need to reschedule. Do not use the link in the message to determine whether the delivery exists. Open the retailer or delivery account independently and check the order there.

Fake Bank Fraud Alerts

A fake security alert may be designed to make you call the scammer voluntarily. Once you call, the scammer can pretend to be the fraud department and pressure you to disclose codes, reveal financial information, or move money.

If you receive an unexpected bank alert, ignore the supplied number. Open your normal banking app or call the number printed on your card or statement.

Fake Toll, Fine, or Traffic Texts

Treat unexpected demands for tolls, court fees, fines, or traffic payments cautiously—especially when the text threatens immediate penalties and supplies a payment link or QR code.

Navigate independently to the genuine state or court website instead of using information supplied in the text.

Fake Recruiter and Job Texts

A professional-looking recruiter message is not proof of a real vacancy. If the text leads to fees, equipment purchases, check deposits, identity documents, banking details, unfamiliar apps, or a rushed hiring process, use the dedicated Designs24hr guide to verify a suspicious recruiter or job offer before continuing.

Wrong-Number Text Scams

Some scams begin with a message that appears harmless: “Are we still meeting?” or “Is this Sarah?” The goal may simply be to get a response and start a relationship.

If an unknown sender has the wrong number, you do not need to maintain a conversation. Be especially cautious if the person rapidly becomes friendly, moves into personal topics, or starts discussing investing, cryptocurrency, business opportunities, or money.

5. Can You Use ChatGPT or Another AI Tool to Check a Suspicious Text?

AI can be useful as a secondary analysis tool. It may help you identify pressure language, summarize what the sender is requesting, notice suspicious patterns, or generate a list of things that need independent verification.

But a chatbot usually cannot prove who owns the phone number, whether the sender’s account was compromised, whether the linked site is currently safe, whether the claimed transaction occurred, or whether the message itself was written by AI.

Redact Private Information First

Before pasting any suspicious message into an AI service, remove or replace:

• your name and other people’s names,
• private phone numbers and email addresses,
• home or work addresses,
• account, card, bank, or tax numbers,
• Social Security numbers and government identifiers,
• passwords, PINs, recovery codes, and one-time codes,
• live login, password-reset, invitation, or account-verification links,
• confidential employer or customer information, and
• private medical, financial, legal, student, or family information.

For a broader privacy check, review what not to share with ChatGPT or other AI chatbots before pasting private content into an AI system.

I received the following suspicious text. I have replaced all names, phone numbers, account information, private details, and live links with placeholders.

TEXT:
[Paste a fully redacted version here]

Please:
1. Explain exactly what action the sender wants me to take.
2. Identify pressure tactics or suspicious requests.
3. Separate weak clues from high-risk warning signs.
4. List what I should verify independently.
5. Tell me what information I should NOT share.
6. Do not declare the message safe just from its wording.

I will verify the claim separately through an official app, known website, saved contact, or other trusted channel.

6. What to Do If You Already Clicked, Replied, Shared Information, or Paid

Your next step depends on what actually happened. Simply receiving or reading a suspicious text is different from entering a password, sending a verification code, installing software, exposing identity information, or sending money.

If You Entered a Password

Secure the genuine account first. Change the exposed password directly through the real service, review unfamiliar sessions, and enable strong multifactor authentication or a passkey where supported.

If you need a new unique password, you can create a strong replacement password with the free Designs24hr Password Generator. Store important passwords in a trusted password manager and avoid reusing the same password on multiple accounts.

If You Lost Money

Contact the payment provider immediately. Speed can matter, but available options depend on the payment method, timing, provider, and circumstances.

Be especially cautious after a loss. Scammers may contact victims again and claim they can recover the money for an upfront fee or additional personal information. Before paying anyone who promises recovery, use the Designs24hr guide to avoid recovery scams after losing money.

7. How to Report Scam Text Messages in the U.S.

Reporting helps mobile providers and authorities identify scam patterns. The FTC currently recommends using your phone’s reporting option or forwarding unwanted scam texts to 7726 (SPAM).

If personal identifying information may have been exposed, use IdentityTheft.gov for U.S. identity-theft recovery guidance based on what information was compromised.

8. Three Fictional Text Message Scams Explained

The following examples are fictional and created for education. The domain names use the reserved .example ending and are not real destinations.

9. Text Scam vs. Email Phishing: What Changes?

Text-message scams and phishing emails use many of the same social-engineering techniques, but the verification details differ. Texts emphasize phone numbers, SMS links, messaging-app handoffs, QR codes, short mobile interactions, and replies. Email verification often requires closer attention to full sender addresses, Reply-To fields, attachments, and email-specific link behavior.

If the suspicious message arrived by email instead, use the dedicated 60-second guide for checking whether an email is phishing.

10. Frequently Asked Questions About Text Message Scams

How can I tell if a text message is a scam?

Focus on what the text asks you to do. Unexpected requests to click, call, log in, send a code, provide sensitive information, pay, download something, or move to another platform deserve independent verification. Do not use the suspicious text’s own link, phone number, or reply route to prove that it is genuine.

What is smishing?

Smishing is phishing conducted through SMS or MMS text messages. The goal may be to steal credentials, money, personal information, or account access, or to move the target into another stage of a social-engineering scam.

Does perfect grammar mean a text is legitimate?

No. Professional language, correct grammar, personalization, and familiar terminology do not prove who sent a message. The FBI has warned that criminals can use generative AI to create believable text and reduce grammatical or spelling errors.

Can AI tell whether a suspicious text is fake?

AI can point out suspicious language or high-risk requests, but it generally cannot prove that the visible sender, account, link, transaction, or underlying claim is genuine. Use AI to generate questions to investigate, then verify the claim independently.

Should I reply STOP to a suspicious text?

If you believe an unexpected message may be fraudulent rather than a legitimate marketing message, the safer approach is generally not to engage with the sender. Use your phone’s spam/junk reporting tools and follow current carrier or FTC reporting guidance instead.

What happens if I click a scam text link?

Risk depends on what happened after the click. If you entered nothing and installed nothing, close the page and check whether anything downloaded or requested permissions. If you entered credentials, shared a code, installed software, or provided financial information, secure the affected account, device, or financial relationship immediately through trusted channels.

What should I do if I gave a scammer my password?

Go directly to the genuine service and change the password immediately. Review active sessions, recovery information, connected apps, and multifactor-authentication settings. Replace the password anywhere it was reused.

How do I report scam text messages?

In the U.S., use your messaging app’s junk/spam reporting option when available, forward unwanted scam texts to 7726 (SPAM), and report consumer fraud through ReportFraud.ftc.gov. Internet-enabled crime can also be reported through IC3.gov.

Continue With the Right Safety Guide

Sources and Review Notes