Scam Texts in 2026: The Tell Is Structural Now, Not Spelling

For twenty years the advice was: look for the bad grammar. That advice is now actively dangerous, because the grammar is fine. The messages are short, clean, correctly punctuated and plausible, and the ones that aren't are getting rewritten by the same tools everyone else uses.

So the tells have moved. What's left is structure — what the message asks you to do, which direction it asks you to travel, and how much it asks for. None of that depends on how well it's written, which is why it still works in 2026 and will still work next year.

The scale is worth a sentence, because it explains why your phone buzzes this often. Imposter scams were the FTC's most-reported category for the ninth consecutive year, with more than a million reports in 2025 and losses up nearly 20% to $3.5 billion; government-imposter reports alone rose 40%, driven in part by overdue-toll messages. Consumers reported losing $470 million to scams that started with a text in 2024. And the per-incident number is going the wrong way: a US PIRG analysis of FTC data put the average reported loss at $1,960 in the first half of 2026, up 35% year on year.

What they look like now

The third one is the most instructive, because it has nothing to steal. There's no link, no payment, no urgency — only an opening. You write back sorry, wrong number, they apologise charmingly, and a conversation begins that will run for weeks before anyone mentions a trading platform. The FTC groups the outcome under investment fraud; the text itself is just the door.

The "reply Y" trick

This one deserves its own section because it inverts a safety feature into the attack.

Messaging apps hide links from senders you've never spoken to. The campaign's answer was to ask you to undo that yourself: reply Y and reopen the message. It works because it mimics something you genuinely do — confirming a dental appointment, an order, a delivery window. Security researchers tracked these domains impersonating toll operators and parcel carriers across at least ten US states and Ontario.

The important consequence is counterintuitive: "STOP" is a reply. On a legitimate marketing list, STOP is your legal right and it works. On a scam message it does two favours at once — it re-enables the link and tells them a human is reading. Report it as junk instead.

The structural tells

Five of them, none of which care how well the message is written.

1. It arrives unprompted and brings its own deadline. Real organisations you owe money to have been writing to you for weeks.
2. It asks you to travel through it. A link, a phone number, an app to install. The message is the only road it offers.
3. The amount is small. $12.51, not $1,251. The figure is chosen to be below the threshold where you'd stop and check.
4. It wants a reply — any reply. See above.
5. The channel is wrong for the claim. This is the strongest one, because it requires no judgement at all. As the FTC put it in June 2026: no toll authority or DMV collects money by text. Neither do courts, the IRS, or your bank's fraud department.

The current roster

What the text says	What's actually true	What to do instead
"Unpaid toll of $12.51, $50 late fee"	No US toll authority collects payment by text	Open your toll account yourself
"Package on hold, confirm your address"	Carriers don't need a text reply to deliver	Track from the retailer's order page
"Overdue traffic ticket — pay or lose your registration"	Courts and the DMV don't text payment demands	Call the court from a number you looked up
"Reply Y to activate this link"	A reply only switches the link on and confirms you exist	Delete and report junk
"Your bank: did you authorise $482? Reply N"	A real alert ends inside the message; it doesn't lead to a call asking you to act	Hang up, call the number on your card
"Read me the code we just texted you"	The code is genuine — they triggered it. Nobody legitimate ever asks for it	Never read a code aloud to anyone
"Move your money to a safe account"	No bank has ever asked anyone to do this	End the call; call the bank yourself
"Hi! Sorry, wrong number" small talk	The opening move of an investment scam	Don't reply at all
"Remote work, $500/day, reply to start"	Job-scam texts are the fastest-growing category — around 31,000 reports in Q1 2026 alone	Employers don't recruit by cold text

The two-step scams, where the text is only the opener

The dangerous ones don't take your money by text. They use the text to start a phone call, because a voice can improvise and a link can't.

The bank fraud-alert sequence is the most effective of these. A text arrives asking whether you authorised a large purchase — and it may land in the same thread as your bank's real messages, because the sender ID is easy to spoof. You reply N. A call follows within seconds from a number that displays as your bank. The caller is helpful, concerned, and knows some real details about you. Then comes one of two asks: read back the code we've just sent you, or move your balance into a "safe account" while we investigate.

Both asks are the entire scam, and both have clean answers:

• The code is real. They triggered it by starting a password reset at that exact moment, which is why it arrives from the genuine short code. Reading it aloud is handing over the key. No legitimate organisation ever asks for one.
• There is no such thing as a safe account. No bank has ever asked a customer to move money to protect it. The request itself is the proof.

The defence is the same for both: hang up, wait a moment, and call the number printed on your card or open the bank's app yourself. If the call was genuine, nothing is lost by calling back. If it wasn't, you've just ended it.

The one rule

That's the whole defence, and it's why it doesn't matter how convincing the message is. You never have to decide whether a text is genuine. You only have to decide to answer the question somewhere else. If you really do owe a toll, your toll account will say so. If a parcel really is held, the retailer's order page will say so. If your bank really did flag a charge, it's in the app.

The same instinct protects you on the web, where the equivalent move is checking the address bar rather than the page: here's how fake storefronts give themselves away.

What to do with the message itself

• Report junk in your messaging app. One tap, and it feeds the carrier's filters.
• Forward it to 7726 (that's SPAM on the keypad), which is free and works across US carriers. The FTC recommends both. Note that only plain text messages forward — picture messages generally won't.
• Report the scam at reportfraud.ftc.gov if money or personal data was involved.
• Don't reply, don't tap, don't call the number in it, and don't save the sender as a contact.

If you already clicked

Most of the time, opening the page alone does nothing. The damage comes from what you typed into it, so work backwards from that.

• Entered a card number? Freeze or replace the card in your banking app — most let you do it instantly — and watch for small test charges. If something lands, a chargeback is a stronger position than a plea.
• Entered a password? Change it, and change it anywhere you reused it. Turn on two-factor authentication while you're there.
• Read out a one-time code? Call the bank immediately on the number on your card. This is the urgent one.
• Gave up a Social Security number or date of birth? That's the case for freezing your credit at all three bureaus — it's free, takes about fifteen minutes, and blocks the thing they're going to try next.

The short version

• The spelling tell is dead. Judge structure, not style.
• No toll authority, DMV, court or bank collects money by text. That single fact disposes of most of them.
• The amount is deliberately small so you'll pay without checking.
• Never reply — not Y, not STOP. A reply turns the link on and confirms you're real.
• Never read a one-time code aloud. It's genuine precisely because they triggered it.
• There is no safe account.
• Always answer the question somewhere other than the message: your own app, your own saved address, the number on your card.