The short answer
- An unexpected text that asks you to tap a link to pay a small fee, "confirm" card details, or share a code or your Medicare Number is very likely a scam. Don't tap the link, and don't reply.
- Check for yourself. Open the company's app, type its web address yourself, or call the number on your card, bill or account. A real problem will still be there.
- Report the text with your messaging app's "report junk" or "report spam" option, or forward it to 7726 (the number spells SPAM). Then delete it.
- If you already clicked, typed something in or paid, act today. Call your bank or card company first, then use the table below.
Why these texts keep coming
People told the Federal Trade Commission (FTC) they lost $470 million to text scams in 2024, more than five times the 2020 figure, and most fraud is never reported. In a sample of text fraud reports, the most common type was a fake package delivery problem. Fake bank "fraud alerts" and bogus toll notices also made the FTC's top five.
The amounts are small on purpose. A few dollars for "redelivery" or an overdue toll does not seem worth checking. According to the FTC, the real goal is your card number or Social Security number. In April 2024, the FBI's Internet Crime Complaint Center (IC3) said it had received more than 2,000 complaints about fake toll texts since early March of that year, with nearly the same wording from state to state.
The 30-second check
Before you do anything, ask:
- Was I expecting this? You never signed up for texts from this sender, have no toll account, or are not waiting for a package from this company.
- Does it want me to tap a link to pay, "update" a card or log in?
- Does it ask for a one-time code, password, PIN, Social Security number, driver's license number or Medicare Number?
- Is there a deadline or a threat, such as a late fee, a suspended license, a returned package or a locked account?
- Is the web address a little off, with extra words, a strange ending, or a name close to the real one but not exact?
- Did it come from an unknown number or an email address?
One "yes" is enough to stop and check another way. Don't judge by how real the text looks. The links lead to copycat sites built to look like the real thing.
What the real organizations say
| If the text claims to be from… | What the organization or officials say | How to check it yourself |
|---|---|---|
| The U.S. Postal Service or another carrier | According to the U.S. Postal Inspection Service, USPS does not text or email you unless you first asked for updates using a tracking number, and those texts will not contain a link. | Type usps.com yourself and enter the tracking number from your receipt. For other carriers or stores, use their app or type their address, with the tracking number from your order. |
| A toll agency | The FTC and FBI warn of fake "unpaid toll" texts nationwide. In California, the Attorney General says The Toll Roads and other California toll agencies do not text people who do not have an account, and FasTrak does not ask for payment by text with a link. | Log in to your toll account through its app or a website you typed or saved yourself. No toll account? Then, by the Attorney General's statement, a California toll agency did not send that text. |
| The California DMV | The DMV says it "will never send a text message to ask for personal or financial information." | Type dmv.ca.gov yourself, or call the DMV at 1-800-777-0133. |
| Your bank or card company | Your bank may send real alerts. But the FBI says companies generally do not contact you to ask for your username, password or one-time code. | Call the number on the back of your card or on your statement, not a number from the text. |
| Medicare | The FTC says real Medicare representatives won't call, text or email you out of the blue to ask for your numbers or a payment. Real Medicare cards are free and mailed to you automatically. | Call 1-800-MEDICARE (1-800-633-4227). |
The Centers for Medicare & Medicaid Services (CMS) puts it plainly in its fraud-prevention materials: a call, text or email asking for your Medicare Number is a scam.
"But I do get real texts from them"
You might: USPS tracking texts you signed up for, a bank alert about a strange charge, a message from your toll account. So use one habit for every message: don't use the link or the phone number in the text. Open the app, type the address, or call a number you already have. A real alert will show up there too.
Fake bank alerts often ask you to reply YES or NO. Then someone calls from a "fraud department." The FTC says that caller pushes people to move money into a "safe" account that belongs to the scammer. The FTC's rule: never move or send money because of an unexpected call or message, no matter who the person says they are.
Report it, then delete it
- Tell your phone company. Use your messaging app's "report junk" or "report spam" option, or forward the text to 7726. The FTC says this helps your wireless provider block similar messages.
- Report it to the FTC at ReportFraud.ftc.gov.
- Add a report where it fits:
- Delete the text. Don't reply, not even to argue.
Already clicked, replied or paid? Do this now
Don't wait to see what happens. Start with anything that involves money.
| What happened | What to do now |
|---|---|
| You tapped the link but typed nothing | Close the page. The Postal Inspection Service says to tell your bank or card company if you interacted with the link at all, even without pressing "submit." If a file or app downloaded, delete it, and stop logging in to accounts on that device until you run a security scan. Then change your passwords and turn on two-step login (two-factor authentication: a second check, such as a code, when you sign in). |
| You entered a card number or paid a "fee" | Call the card company using the number on the back of the card. Say it was fraud. Ask them to block the card, send a new one and reverse the charge. Watch your statements. |
| You entered a bank login or a one-time code | Call your bank right away. Change that password, typing the bank's address yourself, and change it anywhere else you used it. Turn on two-step login. Ask the bank to check for new payees or transfers. |
| You sent money by bank transfer, Zelle, wire, payment app, gift card or cryptocurrency | Contact the bank, app, wire company, gift card company or crypto exchange immediately. Say you were scammed and ask them to reverse the payment. This money can be hard to get back, so speed matters. |
| You gave your Social Security number, driver's license number or date of birth | Go to IdentityTheft.gov. If someone has used your information, report it there and follow the recovery plan. If you are not sure, the site has steps for information that was exposed but not yet misused. Consider a free credit freeze (below). |
| You gave your Medicare Number | Call 1-800-MEDICARE. Compare your Medicare statements with the care you actually got. In California, the Senior Medicare Patrol takes fraud reports at 1-855-613-7080. |
Example (fictional): A retired school cook gets a text: "FasTrak: unpaid toll balance of $6.99. Pay today to avoid a late fee." She has never had a toll account, but she taps the link and types in her debit card number before she stops. That evening she calls the number on the back of her card, reports fraud and asks for a new card. She forwards the text to 7726, reports it at ReportFraud.ftc.gov and ic3.gov, deletes it, and keeps watching her statements.
Why speed matters with debit cards and bank accounts
Under federal rules (Regulation E), if someone uses your debit card or bank account without permission, your loss is capped at $50 when you tell your bank within two business days after learning your details were stolen. Wait longer and the cap can rise to $500. It can go higher if you don't report a charge within 60 days after the statement showing it was sent. A payment you made yourself, even because of a lie, may be treated differently, so ask the bank how it will handle each one. Credit cards have their own federal protection against charges you didn't make.
Credit freeze or fraud alert?
- Credit freeze. The FTC says that while a freeze is on, nobody can open a new credit account in your name, including you, until you lift it. It is free, does not affect your credit score, and lasts until you lift it. You contact each of the three credit bureaus: Equifax, Experian and TransUnion.
- Fraud alert. Lenders must confirm it is really you before giving new credit in your name. It lasts one year and can be renewed. Contact one bureau, and it must tell the other two.
Keep a record, and watch for a second scam
Save a screenshot showing the sender and date. Write down the web address without opening it, any amounts paid and who you spoke with. Agencies and banks ask for details like these.
Be wary of anyone offering to get your money back. Scammers pose as the FBI's complaint center to target people who already lost money. The FBI says IC3 will never contact people directly by phone, email, social media or apps, and will not ask for payment to recover lost money.
Helping a parent, neighbor or friend
- Turn on filtering. Many phones have a setting that filters texts from unknown senders. The FTC also suggests asking the wireless provider about blocking tools.
- Agree on one rule. Nobody pays or shares a number because of a text until they have called the company at a number they already have, or called you.
- Write down the real numbers now. The scam text check card has space for them.
- Know the busy seasons. The FTC warns people to watch for Medicare impersonators during Open Enrollment, October 15 to December 7. Real news also gives scammers a script: in October 2026, CMS described a one-time $90 Part B premium rebate paid by direct deposit or check, with an email or letter to most people receiving it. A text asking for your Medicare Number or bank details to "release" a Medicare payment fits the scam pattern; call 1-800-MEDICARE instead. In California, HICAP offers free Medicare counseling at 1-800-434-0222.
Related reading on this site
- Verify before you pay: five scam shapes covers phone scams too: bank impersonation calls, cloned-voice family emergencies, Medicare calls and utility shutoff threats.
- How to check an investment offer before you send money helps when a "wrong number" text turns into an investment pitch.
Sources
- Top text scams of 2024 (Data Spotlight) — Federal Trade Commission, April 14, 2025.
- Got a text about unpaid tolls? It's probably a scam — Federal Trade Commission, January 17, 2025.
- How to Recognize and Report Spam Text Messages — Federal Trade Commission, accessed October 21, 2026.
- What To Do if You Were Scammed — Federal Trade Commission, accessed October 21, 2026.
- What To Know About Credit Freezes and Fraud Alerts — Federal Trade Commission, accessed October 21, 2026.
- Malware: How To Protect Against, Detect, and Remove It — Federal Trade Commission, accessed October 21, 2026.
- False alarm, real scam: how scammers are stealing older adults' life savings (Data Spotlight) — Federal Trade Commission, August 7, 2025.
- This Medicare Open Enrollment season, learn how to protect yourself from scams — Federal Trade Commission, September 30, 2025.
- Smishing Scam Regarding Debt for Road Toll Services (Alert I-041224-PSA) — FBI Internet Crime Complaint Center, April 12, 2024.
- Account Takeover Fraud via Impersonation of Financial Institution Support (Alert I-112525-PSA) — FBI Internet Crime Complaint Center, November 25, 2025.
- FBI Warns of Scammers Impersonating the IC3 (Alert I-041825-PSA) — FBI Internet Crime Complaint Center, April 18, 2025.
- Smishing — U.S. Postal Inspection Service, updated May 19, 2025.
- Reporting Medicare fraud & abuse — Medicare.gov (Centers for Medicare & Medicaid Services), accessed October 21, 2026.
- Medicare Fraud Prevention Social Media Toolkit and Drop-in Article — Centers for Medicare & Medicaid Services, undated, accessed October 21, 2026.
- Medicare Improvement Fund Premium Rebate: Frequently Asked Questions — Centers for Medicare & Medicaid Services, October 3, 2026.
- Tell Everyone: Attorney General Bonta Warns Consumers of Surge in Text-Based Toll Scam Activity — California Attorney General, January 2, 2025.
- DMV Warns of Fraudulent Text Scam Asking for Toll Payments — California Department of Motor Vehicles, April 29, 2025.
- 12 CFR 1005.6 — Liability of consumer for unauthorized transfers (Regulation E) — Consumer Financial Protection Bureau, current version accessed October 21, 2026.
- Senior Medicare Patrol — California Department of Aging, accessed October 21, 2026.
- Medicare Counseling (HICAP) — California Department of Aging, accessed October 21, 2026.
- IdentityTheft.gov — Federal Trade Commission, accessed October 21, 2026.
Information notice: this page provides general educational information. It is not medical, legal, financial or insurance advice, and it cannot account for your individual circumstances. Sources checked through October 21, 2026.