Email got harder to attack. Spam filters improved, mail providers started checking who really sent a message, and most people learned to be suspicious of a strange attachment. Text messages got none of that, so that's where the scammers went.
Why texts work so well
A text has no sender reputation, no filtering worth the name, and no formatting for you to judge. It arrives on your lock screen, out of context, while you're driving into town or standing in line. You read it in two seconds and decide in one.
Texts are also short by nature, which hides the usual tells. A phishing email has to look like a real company's newsletter; a phishing text just has to look like a normal text.
The pretexts barely change
We hear about the same handful on support calls, over and over:
- A delivery problem. A package is held up and needs an address confirmed or a small fee paid.
- An unpaid toll or DMV notice. Vague, official-sounding, with a link and a deadline.
- A bank or card alert. "Did you authorize a charge of $X? Reply NO." Replying gets you a phone call from someone very helpful.
- The wrong number opener. A friendly, harmless message to nobody in particular. It isn't a mistake; it's a test to see who answers. Whoever replies gets a long, patient conversation that eventually turns to money or crypto.
The common thread is urgency plus a link. Legitimate outfits do send texts, but they almost never combine "act right now" with "and do it through this link."
What to do instead
Don't reply, don't tap, don't press 1 to be removed. Any response confirms the number belongs to a live person, which is worth money to whoever sent it.
Instead, go to the company yourself—the app you already have installed, or a number off your statement. If there's a real problem, it will be waiting for you there. If there isn't, you have your answer.
Then delete it, and report it as junk if your phone offers that. And if a link ever does get you as far as a login page, that's exactly the moment passkeys earn their keep, because there's no password on that screen to hand over.
The takeaway: a text that wants something from you immediately is a text you should answer somewhere other than the text.