Scam Text Messages in 2026: The Toll, Package, and Bank Texts Hitting Phones Now

A scam text is cheaper to send than a scam call and harder to spot on a small screen, which is why fraud operations moved a large share of their volume to SMS. The message arrives while your mother is in line at the pharmacy, it names something ordinary like a toll or a package, and it asks for one tap. There is no voice to sound wrong, no accent to notice, no pause to catch. This guide covers the three text scams landing on American phones right now, what makes each one work, and how to shut the whole category down.

What is smishing?

Smishing is a scam delivered by text message. The FBI's Internet Crime Complaint Center defines it as a social engineering attack using fake text messages to trick people into downloading malware, sharing sensitive information, or sending money.

The mechanics are the same as a scam call with one difference that matters: the message waits. A call has to be answered in the moment, so a screening habit works against it. A text sits in the inbox until someone is tired, distracted, or expecting a package, and it only has to win once. That patience is why the same three templates keep circulating instead of being retired.

What do the current scam texts say?

The three dominant templates in 2026 are the unpaid toll, the failed package delivery, and the bank fraud alert. Each borrows a real system the recipient already uses.

The unpaid toll text. The FBI issued a public alert about this one after receiving over 2,000 smishing complaints in roughly a month, all reporting texts that impersonated state toll services. The message claims a small unpaid balance, often around $12.51, and threatens a $50 late fee. The FBI noted the texts used almost identical language across states while the sending phone numbers changed. A small amount is the point. Nobody calls their spouse to discuss twelve dollars, they just pay it, and the payment page harvests the card.

The failed delivery text. This one claims a package could not be delivered and needs an address confirmed or a small fee paid. The US Postal Inspection Service is direct about the tell: if you never signed up for USPS tracking on a specific package, the text is not from USPS. The Postal Inspection Service also warns that clicking can install malware or land you on a fake site built to look real.

The bank fraud alert text. The message says a suspicious charge was detected and asks you to reply YES or NO, or to tap a link to verify. Replying anything confirms the number is live. The link leads to a copy of the bank login page, and in the more advanced version a person calls a minute later posing as the fraud department to walk you through moving money to a safe account. That handoff from text to voice is the same authority-and-urgency machinery behind every imposter call, which we break down in how phone scams work.

How can you tell a scam text from a real one?

You can tell by checking the claim somewhere other than the message. Every one of these texts is built to be answered inside itself, and stepping outside it is what breaks the scam.

Reliable signals that a text is fraudulent:

• It arrives unrequested. You did not sign up for toll alerts, you are not expecting that package, you did not just use the card.
• The amount is small. Twelve dollars is designed to be paid rather than questioned. A real fraud department does not chase pocket change by text.
• The link is not the real domain. Fake toll and delivery sites use lookalike domains with extra words or unfamiliar endings. On a phone the address bar truncates, which is exactly what the scammer is counting on.
• It wants a reply. Real automated alerts rarely need you to type anything back. A reply is a signal that a human reads this number.
• It creates a deadline. A late fee, a returned package, a frozen account, all of it exists to stop you from checking.
• It asks for information the sender already has. Your bank knows your account number. A toll authority knows your balance.

The Postal Inspection Service gives the same instruction for the delivery version that applies to all three: do not tap the link, go to the retailer or account you actually ordered from and look up the tracking there.

Why do scam texts hit older adults harder?

Scam texts hit older adults harder because the defense is visual and the format removes every cue a lifetime of phone experience trained them to catch. There is no voice reading from a script, no background call center noise, no pressure they can hear building.

A few things compound it. The link is the trap, and on a phone the full address is nearly impossible to inspect. Many older adults use the same few numbers for real business, so an unfamiliar sender does not stand out the way an unfamiliar caller does. And a text can be reread and reconsidered alone at eleven at night, with nobody in the room to say wait, that looks off. The same isolation that makes voice scams work is worse in text, because we cover the reasons older adults are targeted by phone scammers and none of them go away when the channel changes.

What should you do with a scam text?

Do not tap anything, report it, then delete it. The reporting step takes about ten seconds and it is the part most people skip.

The steps, in order:

1. Do not tap the link and do not reply. Not even STOP. Any response confirms a live number and moves it to a better list.
2. Forward the message to 7726, which spells SPAM on the keypad. Both the FTC and the Postal Inspection Service recommend it, it is free on every major US carrier, and it feeds the number into carrier blocking.
3. Report it. Text scams go to the FTC at ReportFraud.ftc.gov. The FBI asks for toll and other smishing reports at ic3.gov, including the sending number and the link.
4. Verify the claim independently if there is any chance it is real. Call the number on the back of the card, log into the toll account directly, check tracking with the retailer.
5. Delete the message so nobody in the house taps it later.
6. If someone already tapped or entered information, treat it as a compromised account. Change the password, call the bank from the number on the card, watch the statements. The FBI's guidance is to secure the accounts and dispute any unfamiliar charges.

If money already moved, the recovery sequence matters more than the reporting sequence, and we walk through it in what to do when a parent has been scammed.

How do you stop scam texts from arriving at all?

You stop them by filtering the messages before they reach the inbox, which is the only approach that does not depend on catching every single one by eye. Reporting works at the network level and helps everyone eventually. Filtering works today, on this phone.

Carrier tools and phone settings do part of the job. iPhone can sort messages from unknown senders into a separate list, Android flags suspected spam, and every major carrier runs some level of network filtering. All of it is pattern based and none of it was built for a parent who should never see the message in the first place.

Scammer Guardian filters scam texts before they reach the phone of the person you are protecting, alongside the AI screening that answers unknown calls. Blocked messages show up in your morning summary rather than in her inbox, so the toll text and the delivery text and the fraud alert all get handled without her ever making a judgment call about a link. One account covers up to four family members, her number does not change, and after the one-time setup she does not touch the app again.

The bottom line

Scam texts work on volume and patience. The toll balance is small enough to pay without thinking, the delivery notice is plausible enough in a week when something really is coming, and the fraud alert sounds like the thing a bank is supposed to do. The rules that defeat all three are short: never tap a link in an unrequested text, never reply, verify the claim through a number or an account you looked up yourself, forward to 7726, and report it. A phone that filters those messages applies every one of those rules automatically, every day, without anyone having to remember them at eleven at night.

See how Scammer Guardian screens calls and filters scam texts, so the message never reaches the person you are protecting.