How to tell if a text is a scam

Before you do anything a text tells you to, run it through three questions. If the answer to any of them is “yes,” stop and verify before you act.

1. 1Was I expecting this? An out-of-the-blue text about a parcel you didn't order, a toll you didn't incur, or an account problem you knew nothing about is the number-one warning sign.
2. 2Is it rushing me or scaring me? “Act now,” “final notice,” “your account will be suspended” — urgency is a manufactured tactic to stop you thinking.
3. 3Does it want a tap, a payment, or my details? The whole point of a scam text is to get you onto a fake page or to send money. If that's the ask, treat it as a scam until proven otherwise.

The safest default with any text about money or accounts is to do nothing the message tells you to, and instead reach the organisation through a channel you already trust.

Most scam texts trip at least two or three of these. The more you spot, the more confident you can be it's fake.

• It creates urgency or fear — “your account will be closed,” “final notice,” “act within 24 hours.” Real organisations rarely give you a same-day deadline by text.
• It contains a link asking you to “verify,” “confirm,” “pay a small fee,” or “reschedule.” Legitimate SMS from banks, government and couriers almost never ask you to enter card or login details from a texted link.
• The link is a lookalike or shortened URL — auspost-redelivery.info, mygov-au.com, a bit.ly link, or a domain with extra words bolted on. The real domain is short and exact (auspost.com.au, my.gov.au).
• It addresses you generically (“Dear customer,” “Hi user”) or has odd spacing, missing words, or stilted grammar.
• It comes from a normal mobile number (+61 4xx or an overseas number) when you'd expect a registered business sender ID. Scammers can't easily fake a brand's official alphanumeric sender ID.
• It asks for payment by gift card, cryptocurrency, or a transfer to a “safe account.” No real bank or agency ever asks for this.
• It's unexpected — you didn't order a parcel, you don't owe a toll, you never asked for a verification code. An out-of-the-blue text about money is the single biggest tell.

The link is where a scam text does its damage, so this is the skill worth learning. You can inspect a link without opening it — on an iPhone, press and hold the link to preview the full address; on Android, do the same to copy it and read it before pasting anywhere.

Read a web address from right to left. The real domain is the part immediately before the first single slash. Inauspost.com.au.parcel-track.info/redeliverthe true domain isparcel-track.info— not Australia Post at all. Watch for these tricks:

• Extra words bolted on: auspost-redelivery.com, mygov-secure.net, commbank-alerts.com. The real brand uses a short exact domain (auspost.com.au, my.gov.au, commbank.com.au) with nothing tacked on.
• Lookalike characters: a zero for an “o,” an “rn” that reads as “m,” or an unusual ending like .info, .top, .xyz or .vip on something claiming to be a major Australian brand.
• Shorteners: bit.ly, tinyurl, or t.co links hide the real destination. A real bank or government text won't send you to a shortened link.

When in doubt, don't tap at all. Go to the site yourself by typing the address you know, or open the official app.

If a message could plausibly be real and you need to know for sure, verify it on your own terms — never through the details in the text itself.

• Don't reply, and don't tap the link. Replying confirms your number is live and invites more.
• Find the organisation's real contact details yourself — type the address into your browser, use the number on the back of your bank card, or open the company's official app. Never use a number or link from the text.
• Log in to your account directly (banking app, myGov, the courier's tracking page) and check whether the claim is actually true. A genuine alert will be reflected inside your account.
• If it claims to be someone you know asking for money or gift cards, call them on the number you already have for them before doing anything.
• If you're still unsure, paste the message into a scam checker for a second opinion — it costs you nothing and takes seconds.

Two specifics worth remembering for Australia: genuine banks never ask you to move money to a “safe account” (that instruction is always a scam), and you can forward a scam SMS to 7226 (which spells “SPAM”) free of charge so your carrier can help block the source.

A handful of templates account for most of the scam texts Australians receive. Recognising the shape of each makes them far easier to dismiss on sight:

• Delivery / parcel texts claiming a package is held, needs a small redelivery fee, or has an “incomplete address.” Often impersonate Australia Post. See our delivery & parcel scams guide.
• Unpaid-toll texts demanding a few dollars for a toll “before your fine increases.” The small amount is bait to harvest your card details — read the unpaid toll scams guide.
• Bank “fraud alert” texts warning of a suspicious payment and asking you to call or tap to stop it — frequently posing as Commonwealth Bank. See bank impersonation scams.
• Tax and government texts promising a refund or threatening a debt, impersonating the Australian Taxation Office or myGov. The ATO never texts you a link to claim a refund.
• Account and subscription texts saying a payment failed and your service will be cut off, such as fake Netflix or Telstra billing alerts.

The common thread is the same in every case: an unexpected message, a manufactured deadline, and a link or number that pulls you off the official channel. Spot that pattern and the brand on the label doesn't matter.

Every scam text relies on one thing: getting you to act before you think. The single most effective defence isn't technical — it's giving yourself a few minutes. Nothing genuine falls apart because you paused to check. A real parcel will wait; a real bank alert will still be in your app when you log in directly; a real fine has a proper notice behind it.

If a message has rattled you, that's by design — and it's a good reason to step back rather than tap. Delete obvious scams, report the ones worth reporting, and never feel embarrassed about double- checking. People who lose money to scam texts are rarely careless; they were simply caught at a busy moment by a message engineered to look routine.

If you think you've already tapped a link or entered details, read what to do if you clicked a scam link, and if you want to help others, here's how to report a scam text.