Is this text message real? A quick way to tell

Text message scams have overtaken email, because a text feels more personal and people read them faster and with less suspicion.

Here is how to check one in under a minute.

The quick test

Ask yourself three questions:

1. Was I expecting this? No parcel ordered, no toll trip, no account with that bank means the message is not for you.
2. Does it want me to tap a link or ring a number? Nearly every scam text does.
3. Is it pushing me to hurry? Fees rising, accounts closing, deliveries returning.

Two or three yes answers means delete it.

Then, whatever you decide, apply the rule that covers everything:

Never use the link or the number in the message. Go to the organisation yourself, independently, and check from there.

If the text says your parcel is held, open the courier’s own app or type their address into your browser. If it says your bank has blocked a payment, ring the number on the back of your card. It takes two minutes and it defeats every version of this.

The ones going around

The parcel

“Your package could not be delivered. Please pay a small fee to reschedule.”

Australia Post does not text you asking for a redelivery fee. Neither do the major couriers. The fee is small on purpose, usually a few dollars, because the point is not the money. The point is your card details.

The toll

“You have an unpaid toll. Pay now to avoid a fine.”

Same structure as the parcel. Check through your actual toll account, or ring the toll operator from a number you look up yourself.

The bank alert

“A payment of $980 to [some company] has been approved. If this was not you, call this number.”

This one works by frightening you into ringing the number in the message, which reaches the scammer. They then walk you through “securing” your account, which means emptying it.

Real banks do send genuine fraud alerts. The difference is what you do next: always ring the number on your own card, never the one in the message.

“Hi Mum, this is my new number”

The cruellest one, and it is very common.

A message arrives from an unknown number claiming to be your son or daughter. Their phone is broken or lost. They are using a friend’s phone or a temporary number. Shortly afterwards there is a problem: a bill they cannot pay, a transfer that will not go through, and could you help just this once.

The tone is casual and convincing, and it is designed to work on the one relationship you would never question.

Always ring the old number. If it is genuinely your child, they will answer or you will hear it ring out and can check with somebody else in the family. Never send money based on a text alone, no matter how much it sounds like them.

It is worth agreeing a question with your family in advance that only they would know. Not a birthday or a pet’s name, which are guessable, but something ordinary and specific to you.

The government one

Messages claiming to be myGov, Medicare, Centrelink or the tax office, usually about a refund you are owed or a payment that failed.

Government departments do send texts, but they will not ask you to log in through a link. Open the myGov app or type the address in yourself.

Things that do not prove a message is genuine

It arrived in the same conversation thread as real messages. This surprises people, but scammers can set the sender name to match a real one, and your phone will helpfully file it alongside genuine messages from that organisation. A message appearing under “Australia Post” is not evidence of anything.

It knows your name. Names and phone numbers are traded in bulk after company data breaches.

The link looks right. Look carefully. auspost-delivery.info is not auspost.com.au. The real address is the bit immediately before the first single slash, and scammers construct addresses that start convincingly.

It came from an Australian number. Trivially faked.

If you already tapped the link

Usually nothing happens from tapping alone. The risk is what came next.

• Tapped, then closed it without typing anything? You are almost certainly fine.
• Entered card details? Ring your bank and cancel the card now.
• Entered a password? Change it immediately, and everywhere else you used the same one.
• Installed something when prompted? Have the phone looked at properly.

The longer guide on what to do in the first hour covers each of these in order.

Reducing them

Report scam texts by forwarding them to 7226 (which spells SCAM), a free service run by the Australian Communications and Media Authority. It helps get the numbers blocked for everybody else.

Then delete the message. Do not reply, and do not send “STOP” to a message you did not sign up for, because replying confirms your number is live.

When in doubt, ask

If you are unsure, forward it to somebody. A family member, a friend, or me. It costs nothing and takes a moment.

I would far rather look at twenty messages that turn out to be genuine than have one person spend a fortnight worrying about a message they were too embarrassed to ask about.