The Scam Texts Everyone Is Getting — and the 10-Second Habit That Beats All of Them

I build AI systems for a living, I've been in technology for four decades — and some of the scam texts going around right now would give me pause if I were tired and busy. That's the first thing to understand: these messages aren't aimed at gullible people. They're industrial products, A/B tested on millions of phones, refined until they work on somebody. If one nearly fools you, that isn't a character flaw. That's their job.

The second thing to understand is better news: the scams change constantly, but they all share one weakness — and one ten-second habit defeats every single one of them, including the ones that haven't been invented yet.

The current greatest hits

You've probably received several of these already:

The unpaid toll. "You have an outstanding toll balance. Pay now to avoid penalties." This one has flooded American phones for the past two years — the FBI and FTC have both issued warnings about it. The link leads to a fake toll-agency page that harvests your card number.

The stuck package. "USPS: your package cannot be delivered due to an incomplete address." There is no package. The "redelivery fee" page exists to take your card details — and worse, your password if you reuse one.

The bank fraud alert. "Did you authorize a charge of $847.99 at Walmart? Reply NO or call this number." The scam isn't the text — it's the friendly "fraud department" person who answers when you call their number and helpfully walks you into moving your money to a "safe account." Banks do send fraud texts; they will never ask you to move money.

The wrong number that turns friendly. "Hi, is this Margaret? Are we still on for lunch?" You reply that they've got the wrong number; they apologize charmingly; a conversation starts. Weeks later, your new friend happens to mention an investment that's been working for them. This long con — law enforcement calls it "pig butchering" — costs Americans billions a year, and it starts with a message designed to look like an innocent mistake.

The emergency call that sounds exactly like your grandchild. A panicked voice — their voice — needs bail money or hospital fees, right now, and begs you not to tell their parents. Three seconds of audio from a social media video is enough for cheap AI tools to clone a voice convincingly. The FTC has been warning about this since 2023. This is the cruelest one, and it works because it weaponizes love.

Why they work on smart people

Every one of these has the same skeleton: authority (a bank, a government agency, a family member), urgency (penalties, arrest, a grandchild crying), and a door they provide (their link, their phone number, their gift-card instructions). The whole trick is keeping you inside the message, acting fast, on their territory.

The 10-second habit

Here it is. Tape it to the fridge:

Never act on the message itself. Close it, and go through a door you already trust.

That's the whole thing. Bank text? Close it — open your bank's app, or call the number printed on the back of your card. Package problem? Type usps.com yourself. Toll notice? Look up your state's toll agency directly. Grandchild in trouble? Hang up and call them — or their parents — at the number already in your contacts.

Notice what this habit does not require: it doesn't need you to spot the fake link, judge the grammar, or out-argue a professional manipulator at 9 p.m. when you're tired. Real institutions survive you checking through the front door. Scams cannot. You don't have to win the argument — you just have to leave the room.

Ten seconds. Every message. No exceptions — including the convincing ones. Especially the convincing ones.

One more layer for families: a code word

Pick a family code word this week — something silly that would never come up by accident — and share it at the dinner table. Any genuine emergency call from family must include it. AI can clone a voice from three seconds of video; it cannot know that your family's code word is "rutabaga."

If you already clicked — or already paid

First: you have plenty of company, including engineers and professors, so skip the shame and move fast. Reported fraud losses run into the billions every year in the US, and the unreported number is larger precisely because people feel embarrassed. Don't be. Act:

1. Money or card details involved? Call your bank or card company immediately — the number on the back of the card. Fast reporting dramatically improves the odds of reversal.
2. Typed a password? Change it on the real site now — and anywhere else you used the same password (this is why password reuse is the real danger; I've written a separate guide on fixing that for good).
3. Freeze your credit at the three bureaus. Free, reversible, and it slams the door on new accounts in your name.
4. Report it at reportfraud.ftc.gov and ic3.gov (the FBI's internet crime center). Reports are what get these rings investigated.
5. Tell someone. Scammers re-target people who stay silent — they literally keep lists. Telling family or a friend breaks that.

The scammers' product is fear and hurry. Your defense is ten seconds of calm. It's a fair fight, and you're better armed than you think.