Quick answer: Do not tap links or open attachments in unexpected messages. Contact the company using a phone number or website you already know, then forward the message to 7726 (US and UK texts) and delete it. If you already clicked, update your security software and run a scan.
Phishing messages pretend to come from a bank, delivery firm, government agency or payment app. They try to rush you into a link that steals passwords or installs malware. Texts and emails both work this way, and the habits that protect you are the same in the US, UK, Canada, Australia and the EU.
This guide gives a quick checklist, a step-by-step response plan and the official ways to report scams in the US and UK.
How can I tell a message is phishing?
The FTC lists common signs. The message is unexpected and appears to come from a company you know. It claims suspicious activity or a payment problem, asks you to confirm personal details, includes an invoice you do not recognize, or offers a refund or coupon. It may use a generic greeting and push you to click quickly.
The FTC says email was the top contact method scammers used in 2024. It also states that legitimate companies will not email or text a link asking you to update your payment information. That single rule catches many scams.
- Urgency: “Act within 24 hours” or “account locked”.
- Unknown sender: you have no account with the company named.
- Link or attachment you did not expect: especially for parcels, tolls, taxes and refunds.
- Request for codes or passwords: no real support team needs your one-time code.
What should I do with a suspicious text or email?
- Stop. Do not click, reply or open attachments. The FTC warns that links and attachments can install malware.
- Check independently. If you think the message could be real, contact the company through a phone number or website you already trust, not the details in the message.
- Report it. See the next section.
- Delete it. The FTC advises deleting the message after reporting.
How do I report phishing in the US and UK?
United States
Per the FTC, forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward texts to SPAM (7726), and file a report at ReportFraud.ftc.gov. Our guide on where to report a scam covers more routes.
United Kingdom
The NCSC says to forward scam texts to 7726, which is free through most providers. Note the sender’s number first. On iPhone, press and hold the message, tap More, select it, tap the arrow, enter 7726 and send. On Android, press and hold the message, tap the three dots, tap Forward, enter 7726 and send. The NCSC says reported numbers can be investigated and blocked by providers. GOV.UK says to forward suspicious emails to report@phishing.gov.uk, where the NCSC investigates them, and not to reply to suspicious texts or click links in emails you are unsure about.
Elsewhere, such as Canada, Australia and Germany, check your national reporting service or your mobile provider, since 7726 does not work everywhere.
What if I already clicked or replied?
The FTC says that if you opened a link or attachment that may have installed malware, you should update your security software, run a scan and remove anything it flags. If you shared a Social Security, card or bank account number, go to IdentityTheft.gov for steps matched to what you lost. In the UK, report fraud losses to Action Fraud via reportfraud.police.uk or 0300 123 2040 (Police Scotland on 101), as the NCSC notes.
If you installed an app from a text, the NCSC’s parcel-scam advice is stricter: do not log in to any accounts on that device, factory reset it as soon as you can without backing up first, change passwords for accounts you used since the install, and use a unique password for each. This advice concerns banking malware disguised as parcel-tracking apps. If bank details were involved, call your bank straight away. You may also want to check whether your data appeared in a breach.
How can I make phishing less likely to work?
- Turn on multi-factor authentication. The FTC suggests a one-time code, authenticator app, security key or biometric. See how to set up an authenticator app, or switch to passkeys.
- Keep security software and phone updates on automatic.
- Back up your computer and phone so malware cannot hold your files hostage.
- Use spam filters, but do not rely on them alone.
- Limit personal information you share publicly. The NCSC notes criminals use it to make scams convincing.
More practical guides are in our more Security guides section.
Frequently asked questions
Is it safe to reply STOP to a scam text?
The sources reviewed do not recommend replying. The FTC’s advice is to avoid engaging, report the message and delete it.
What does 7726 spell?
It spells SPAM on a phone keypad. The FTC and the NCSC both point to it for forwarding scam texts.
Can a real company send me a link?
Companies can message you, but the FTC says they will not send a link to update your payment information. Use their official app or website instead.
Should I delete the message right away?
Report it first, then delete it, as the FTC advises. In the UK, note the sender’s number before forwarding a text.