THE SCAM TEXT CORPUS · 105 TEXTS · 5 COUNTRIES
By Peter · 30 October 2026 · 14 min read
Scam text examples: 105 of them, verified at source. The real ones read like paperwork. The warnings show you something louder.
A scam text usually wants one tap on a link: 42 of the 52 real scam texts we verified at source asked for exactly that. They name small sums, mostly refunds or benefits offered to you, never more than 620 in our set, and often dress up as official paperwork with case numbers and office names. Of those real texts, 5 told you to reply Y to unlock the link. The examples in official warnings were shorter, louder and named far bigger sums.
Everybody has seen the warning. A grey bubble, a red circle, a line like Your account has been locked. Verify your identity now. It is short, it is loud, and it is easy to spot. The trouble is that it is not what most people actually receive.
So we did something nobody seems to have done. We collected every scam text that regulators, police forces, courts, government bodies, banks, carriers and postal operators in the United States, the United Kingdom, Canada, Australia and Ireland had published as text on their own pages, checked each one word for word at the source, and read them side by side. Some were captured from real campaigns. The rest were the publishers' own typical examples, the kind written for a warning. Reading the two piles together is where the finding is.
How we built the corpus
We only kept a text if the publisher printed it as text on its own page, not as a screenshot we would have to transcribe, and only if it matched that page character for character when we checked it on 30 October 2026. Twelve items, from Bank of Ireland, the Competition and Consumer Protection Commission and Scamwatch, come from the publisher's own written description of its screenshot, its alt text, and the dataset says which. News stories, forums and security vendors were excluded. The result is 105 texts from 32 publishers on 41 pages.
Then we sorted them. 52 are captured messages from real campaigns: the fake Alabama DMV notice, the Royal Mail fee, the Bank of Ireland card block. 53 are the publishers' own typical examples, written to show what a scam looks like. We coded every text the same way, with written rules checked by hand: what it asks you to do, whether it carries a deadline, a threat, a reward or official dressing, whether it names a sum, and whether it asks you to reply to unlock its link.
Finding 1: they want a tap, not a talk
Of the 52 captured texts, 42 ask you to tap a link. 2 ask you to call a number, 4 ask you to reply, and 4 open a conversation. In the warning examples the picture is different: 22 of 53 carry a link and 9 ask you to call. The warnings spend more time on the phone call than the real texts do.
Finding 2: the real ones read like paperwork
16 of the 52 captured texts (31%) dress up as official paperwork: a case number, a reference code, a named office, a cited regulation, the words Final Notice. Only 4 of the 53 warning examples (8%) do. The real texts are longer too, with a median of 25 words against 15.
The fake DMV notices published by the Alabama Department of Revenue and by Clark County District Court in Washington are the clearest case. They cite an administrative code, list five penalties, give a payment deadline and a date enforcement begins. They read like a letter from a records office, because that is what they are pretending to be. The traffic-ticket text and the unpaid toll text are the same family.
Finding 3: small sums, and mostly money coming to you
14 of the captured texts name a sum of money, and none of them is above 620 in its currency. The median is about 150. More telling is which way the money flows: 8 of the 14 are money offered to you, a refund, a rebate, a benefit or a credit. 3 are small fees, such as a Royal Mail settlement of 2.99 GBP and an unpaid toll of $12.51. 3 are charges flagged on your account.
The warning examples go the other way. 10 of them name a sum, the median is about 1,760, and 7 of the 10 are large unrecognised charges, the alarming card payment that makes you panic.
Finding 4: the reply trick the warnings never show
5 of the captured texts tell you to reply before the link will work: the four fake DMV and Department of Licensing notices, and a fake Department for Work and Pensions subsidy text published by Cheshire West and Chester Council. The DMV versions end with almost the same line, Reply Y and re-open this message to click the link, or copy it to your browser. Not one of the 53 warning examples includes an instruction like this.
Finding 5: they do not know your name
Only 1 of the 52 captured texts addressed the recipient by name, and that was an initial in a fake DoorDash support message. The rest open with no greeting, with a sender name, or with something generic such as Dear Customer, Dear client, Dear Team Member, Hi there or Hi Dad. They read like messages sent to lists of numbers, not to people anyone has researched. If a text does know your name, that proves nothing either; names and numbers leak together.
What the warnings get right: the pressure
On one thing the two piles agree. 60% of the captured texts and 62% of the warning examples carry a deadline or a threat: today is the last day, your account will be suspended, enforcement begins on June 8. The clock is constant. Why scammers create urgency covers the mechanics; the short version is that pressure is how they stop you checking.
Twelve real texts, as they arrived
These are captured texts from the corpus, exactly as each publisher printed them. We have only defanged the links, writing hxxp and [.] so nothing here is clickable. The tags are our coding.
For the family emergency, see family impersonation scams. For job texts like the last one, see task scams. Parcel texts are covered in the USPS text, and bank alerts in is this bank text real.
Three lines from real texts, decoded
Each line below is quoted from a captured text in the corpus. For each one: the lever it pulls, why it works on careful people, and the move that breaks it. The analysis is ours; the words are the scammers'.
- Beat 1 · what you hear“Reply Y and re-open this message to click the link, or copy it to your browser.”
The lever: The first small yes.
Why it works: A reply feels like nothing. It is a tiny action you chose, and every salesperson knows the first yes makes the second one easier. The text also tells you plainly why it wants the reply: so the link becomes clickable. You do the work that unlocks the trap.
The counter-move: Treat any instruction to reply before a link works as the scam announcing itself. Delete the text. If you are worried about the fine or the payment, go to the agency's own website by typing the address yourself.
- Beat 2 · what you hear“In accordance with alabama State Administrative Code 15C-16.003”
The lever: Authority by paperwork.
Why it works: A code number reads like a filing system, and a filing system feels like a government. Nobody stops to look up a regulation number while being told their licence is about to be suspended. The number does its job by existing, not by being true.
The counter-move: Never verify a text using details the text gives you. Find the agency yourself and check there. A real fine will still be there when you look it up the slow way.
- Beat 3 · what you hear“So we are giving you back $120.00 CAD. Get hold of it here.”
The lever: The gift before the ask.
Why it works: A refund puts you in the position of the person being served, not the person being sold to. You lower your guard because you are receiving, and the form that collects your card or bank details looks like the paperwork for your own money.
The counter-move: Money owed to you does not need a link from a text. Log in to the account or agency site you already use and look for it there. If it is not there, it was never yours.
The levers in depth: why scammers sound official · why scammers are so nice · the scammer's sales playbook
Five checks before you tap a link in a text
These come straight from the findings. They take about two minutes and work on any text about money, a parcel, a fine or your account.
- Ask what it wants you to tap. Most scam texts exist to get one tap on a link. A link in a text about money, a parcel, a fine or your account is the moment to stop. Go to the company or agency yourself, by typing its address or opening its app.
- Ignore the paperwork. Case numbers, reference codes, office names and legal citations are decoration. They cost the sender nothing. Check the claim on the official site you found yourself, never through the text.
- Distrust money coming to you. A refund, a rebate, a benefit or a cash credit that needs you to tap a link and enter details is the bait, not the payment. Log in to the agency or company account you already have and look there.
- Never reply to unlock a link. If a text tells you to reply Y, or reply and reopen the message so the link works, it is asking for your first small yes. A real organisation never needs a reply before its own link works.
- Do not let a small sum relax you. A fee of a few pounds or dollars is designed to feel too small to question. The card details you type to pay it are worth far more to the sender than the fee.
What to do with a scam text
Do not tap it and do not reply. Forward it to 7726, a free reporting shortcode supported by the major carriers in four of the five countries (in Australia, use 7226), then delete it. Our country checkers explain what happens next and where else to report: the United States, the United Kingdom, Canada, Australia and Ireland.
If you already tapped and typed something in, the order matters. Card or bank details: call your bank now, using the number on your card or in its app. A password: change it on the real site and anywhere you reused it. Money sent: see what to do in the first hour, by how you paid.
All 105 texts
The full corpus, exactly as each publisher printed it, links defanged. The same data, with our coding for every text, is in the CSV download (free to reuse with credit, CC BY 4.0). If you get a text and want to know whether it has been seen before, search this page for an unusual phrase from it.
52 captured texts from real campaigns
- T001 · United States · bank, card or payment · United States Postal Service (USPS News)
Dear Team Member, your account has been compromised. Click this link to verify your credentials. — USPS Leadership.
- T004 · United States · phone carrier or reward · AT&T
www[.]att620[.]com - Simply sign in to your account to redeem your $620. At AT&T we care about you. Thank you and have a nice day.
- T005 · United States · toll, parking or traffic fine · Maryland Attorney General (consumer alert bulletin)
Maryland Toll Services: We've noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit hxxps://sunspasstolls[.]com to settle your invoice.
- T006 · United States · toll, parking or traffic fine · Alabama Department of Revenue
Alabama Department of Vehicles(DMV) Final Notice: Enforcement Penalties Begin on June 8. Our records show that as of today, you still have an outstanding traffic ticket. In accordance with alabama State Administrative Code 15C-16.003, if you do not complete payment by June 7, 2025, we will take the following actions: 1. Report to the DMV violation database 2. Suspend your vehicle registration starting June 8 3. Suspend driving privileges for 30 days 4. Transfer to a toll booth and charge a 35% service fee 5. You may be prosecuted and your credit score will be affected Pay Now: hxxps://mydmv[.]alabama-govlv[.]today/us Please pay immediately before enforcement to avoid license suspension and further legal disputes. (Reply Y and re-open this message to click the link, or copy it to your browser.)
- T007 · United States · toll, parking or traffic fine · Clark County District Court (Washington)
Departmet of Licensing (DOL) Final Notice: Enforcement Penalties Begin on June 29. Our records show that as of today, you still have an outstanding traffic ticket. In accordance with Washington State car Administrative Code D508-12.083, If you do not complete payment by June 28, 2025, we will take the following actions: Report to the DOL violation database Suspend your vehicle registration starting June 29 Suspend driving privileges for 30 days Transfer to a toll booth and charge a 40% service fee You may be prosecuted and your credit score will be affected Pay Now: "_h_t_t_p_://dol-wa[.]gov-heec[.]_live/pay" (Underscoring added to disrupt link) Please pay immediately before enforcement to avoid license suspension and further legal disputes. (Reply Y and re-open this message to click the link, or copy it to your browser.)
- T008 · United States · toll, parking or traffic fine · Clark County District Court (Washington)
Final notice from the Washington State Motor Vehicle Administration: Law enforcement will begin on June 25. Our records show that as of today, you still have unpaid traffic tickets. Under Washington State Administrative Rule 15C-16.003, if you fail to make a payment by June 24, 2025, we will take the following actions: 1. Report to the Motor Vehicle Administration’s illegal database 2. Vehicle registration will be suspended from June 25, 2025 3. Suspend driving privileges for 30 days 4. Charge a 35% service fee at the toll station 5. You may be sued and your credit score may be affected. Pay now: "hxxps://wsdot[.]sim-blg[.]icu_" (Underscoring added to disrupt link) Please make payments before execution to avoid licence suspension and further legal issues. (Reply to "Y" and reopen this email to click on the link, or copy it to your browser.)
- T009 · United States · toll, parking or traffic fine · Clark County District Court (Washington)
Seattle Vehicle Administration(DMV) Final Notice: Enforcement Penalties Begin on June 28. Our records show that as of today, you still have an outstanding traffic ticket. In accordance with Seattle car Administrative Code 15C-16.003, If you do not complete payment by June 27, 2025, we will take the following actions: Report to the DMV violation database Suspend your vehicle registration starting June 28 Suspend driving privileges for 30 days Transfer to a toll booth and charge a 35% service fee You may be prosecuted and your credit score will be affected Pay Now: "hxxp://wsdot-mhw[.]wang/_trave_l" (Underscoring added to disrupt link) Please pay immediately before enforcement to avoid license suspension and further legal disputes. (Reply Y and re-open this message to click the link, or copy it to your browser.)
- T010 · United States · toll, parking or traffic fine · Superior Court of California, County of Calaveras
California Supreme Court – Traffic Violation Summons Case Number: CA HC 2026 TR 43809 Failure to appear will lead to an arrest warrant, suspension of your driver's license, impoundment of your vehicle, and civil penalties including wage garnishment and asset seizure.
- T021 · United States · toll, parking or traffic fine · FBI Internet Crime Complaint Center (IC3)
(State Toll Service Name): We've noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit hxxps://myturnpiketollservices[.]com to settle your balance.
- T022 · United States · government payment, tax or benefit · FBI Internet Crime Complaint Center (IC3) with TIGTA
IRS[.]gov You have received tax relief in disaster situations Status Amount of $303,40 is available to claim. IR-2022-156, Saturday 17 September. September is National Preparedness Month: IRS urges everyone to update and secure their records to prepare now for natural disasters. Submit Application & Complete Registration From here. hxxp://lubinaf[.]me/?irs-deducted-taxes-record=[REMOVED]
- T023 · United Kingdom · toll, parking or traffic fine · Driver and Vehicle Standards Agency (GOV.UK)
Dvsa notice for you: You have a parking penalty charge due on 2024/9/30. If you do not pay your fine on time, Your car may be banned from driving, you might haeve to pay more, or you could be taken to court. Please enter your license plate in the link after reading the information, Check and pay parcking penatly charge. Thank you again for your copperation. Dvsa.
- T024 · United Kingdom · toll, parking or traffic fine · Driver and Vehicle Standards Agency (GOV.UK)
DVSA Fixed Penalty Office: Today is the last day to pay your ticket due to your long term delinquency, if you do not pay your ticket on time you may be required to pay more in the future and we reserve the right to prosecute you. Please be patient and open the link below to process your ticket. Thank you again for your co-operation.
- T025 · United Kingdom · toll, parking or traffic fine · Driver and Vehicle Standards Agency (GOV.UK)
DVSA Fixed Penalty Office last notification : You have not paid your ticket within the stipulated time. Today is the last time to notify you to pay. We will ban your car from driving on the road starting tomorrow and transfer your parking ticket to the court. Please wait until you receive the information. Process your ticket as soon as possible in the link.
- T026 · United Kingdom · toll, parking or traffic fine · Driver and Vehicle Standards Agency (GOV.UK)
EWHC notice for you you: We are preparing to prosecute you for the materials handed over by DVSA. Because you have not pay your parking penalty charge for a long time. Today is the last day for payment. If you do not pay within today, we will prosecute you. Please read the information and enter your license plate to check your parking ticket.
- T037 · United Kingdom · parcel or delivery · Chartered Trading Standards Institute (CTSI)
your Royal Mail parcel is awaiting delivery. Please confirm the settlement of 2.99 (GBP) on the following link:
- T038 · United Kingdom · government payment, tax or benefit · Cheshire West and Chester Council Trading Standards
DWP Service Centre: You have not yet completed your application for an energy subsidy for 2024-2025. The subsidy is £300. It is important that you submit your application by 10 June. Late applications will not be processed. (LINK) (Please reply “yes” and then exit the text message and re-open to activate the link, or copy the link and open it in your browser). Have a great day, DWP.
- T039 · United Kingdom · government payment, tax or benefit · Highland Council Trading Standards
UK Government Living Allowance Office Last Time Reminder: Due to the reduction of winter heating subsidy, you can no longer receive it, and the uk government has decided to advance the living subsidy to allow you to survive the winter. We will reopen applications. Please apply for your living subsidy in the link as soon as possible after receiving the information. If you do not submit an application before 2024/10/15, we will cancel your qualification and reallocate the funds.
- T040 · United Kingdom · government payment, tax or benefit · Reigate & Banstead Borough Council
Dear Customer. Please note that we have to refund you the amount: 422.40 GBP council tax fee for the past year. Please visit hxxp:/online-council-tax[.]co[.]uk
- T044 · United Kingdom · family or friend · Take Five to Stop Fraud (UK Finance campaign)
Hi Dad, I’ve lost my phone and can’t get on to my mobile banking I urgently need to pay a bill, is there any chance you can help?
- T045 · Ireland · bank, card or payment · Bank of Ireland
BOI: Your account has been limited. Please follow the steps to reactivate: hxxps://updatedonlinesecurity-banking[.]com/
- T046 · Ireland · bank, card or payment · Bank of Ireland
BOI: A payment was attempted from your BOI account, if this was NOT you please visit: boi-online365-secuirty[.]co to cancel any unauthorised payments
- T047 · Ireland · bank, card or payment · Bank of Ireland
Requests have been made on your BOI at 19:57 Was this you? Please visit: hxxps://mobile-boi-online-reviews[.]com/
- T048 · Ireland · parcel or delivery · Bank of Ireland
Hi there - Your parcel has been held at our shipping centre. Please follow instructions here: r1w[.]link/CeYy7
- T049 · Ireland · bank, card or payment · Bank of Ireland
BOI We have placed a block on your card due to a payment of 150 EUR attempted to AMAZON on 28/12/24. If this was not you please follow the steps here: Boi365mobile[.]online
- T050 · Ireland · bank, card or payment · Bank of Ireland
A payee has been added from an unrecognised device on 21/12. If this was NOT you please visit hxxps://confirm-information[.]com route:3
- T051 · Ireland · bank, card or payment · Bank of Ireland
BOI: Payment for 344,29 euro at ARGOS 10:28AM has been placed on hold, If this was not you please contact customer service at: 1800817133
- T052 · Ireland · bank, card or payment · Bank of Ireland
A direct debit of €150.90 is scheduled for 24/01/2025 to Foley's Plumbing Ltd. Ref: IE-BO498. If unrecognised, call (01) 233 7310 immediately.
- T053 · Ireland · parcel or delivery · Competition and Consumer Protection Commission (CCPC)
A customs fee is due for your delivery. Please complete the payment following the link.
- T056 · Canada · phone carrier or reward · Canadian Anti-Fraud Centre
Hello rogers here 'Y' for credit back.
- T057 · Canada · toll, parking or traffic fine · Canadian Anti-Fraud Centre
Your vehicle has an outstanding parking-Infraction that must be settled by 05/13/2022. See
- T058 · Canada · government payment, tax or benefit · Canadian Anti-Fraud Centre
Service Ontario: As you know, we have removed licence plate stickers on all vehicles, so we are giving you back $120.00 CAD. Get hold of it here: [malicious link] *Data rates may apply.
- T059 · Canada · government payment, tax or benefit · Canadian Anti-Fraud Centre
Alberta MMS! We noticed a mistake on your impost because of the recent grant. We sent you $143.70 as a compensation. Get hold of it here [malicious link]
- T060 · Canada · government payment, tax or benefit · Canadian Anti-Fraud Centre
Canadian-benefit[.]gov@outlook[.]com Subj: 100001 Government of Canada sent you $540.00 (CAD) and the money is waiting to be deposited into your bank account. Message: Government of Canada has started to sending out federal payment by e-Transfer. Click hereto deposit your finds: [malicious link] Reference number: CA2vSg6e Data rates may apply.
- T061 · Canada · bank, card or payment · CIBC
CIBC: *ACC*ESS- RESTRIC*TED098*You have (10) news notifications. See:. [link removed]
- T062 · Canada · bank, card or payment · CIBC
(Support Team) Dear client, our system has detected an unusual activity on your CIBC card 4506****. You need to secure your account immediately here:[link removed]
- T063 · Canada · bank, card or payment · CIBC
CIBC : Online access has been restricted. Please visit: [link removed]
- T064 · Canada · bank, card or payment · CIBC
INTERAC: You Received an e-Transfer. Reply “info” for more details.
- T065 · Canada · bank, card or payment · CIBC
CIBC Online Banking: Krishan Patel has been Added as an e-Transfer contact. If this was NOT you, Please follow the link: [link removed]
- T066 · Canada · bank, card or payment · CIBC
CIBC Online Banking: Your CIBC access card 4506-4***-****-XXXX has been limited. To restore your access please visit: [link removed]
- T067 · Canada · phone carrier or reward · CIBC
Your annual 2% cashback is ready to be withdrawed through e-Transfer. Reply ‘Yes’ to claim. [link removed]
- T068 · Canada · government payment, tax or benefit · CIBC
[Service Ontario Alert*]: We have Terminated the usage of license plate stickers for all vehicles, as you may be aware. So, here’s your CAD return of $120.00. It’s available at: [link removed]
- T069 · Canada · government payment, tax or benefit · Canadian Anti-Fraud Centre
CAQ. Un Incitatif de 500.00 a été envoyé aux residents du Québec. Voir [lien malveillant] 25 mars 2022
- T085 · Australia · parcel or delivery · Scamwatch (ACCC)
The delivery time for your parcel is 03/09. Check out your options: example[.]com/g.php?l2r54ya alfal
- T086 · Australia · parcel or delivery · Scamwatch (ACCC)
Your DHL order ID1842225 will arrive soon. Track progress here
- T087 · Australia · parcel or delivery · Scamwatch (ACCC)
Your order will be delivered by DHL tomorrow between 11:26 and 14:26. Track progress example[.]com/n.php?la4pmtf6u yewv
- T088 · Australia · parcel or delivery · Scamwatch (ACCC)
You have (1) Pending Package! Ref: DHL-6461W Last chance to PICK it up > example[.]com/t.php?kdnypf0ng0
- T089 · Australia · parcel or delivery · Scamwatch (ACCC)
You must enter your details 2cc receive your package with DHL crabsunion[.]com/0axazu.php?gdk642k
- T090 · Australia · parcel or delivery · Scamwatch (ACCC)
ARRIVAL today: your Amazon package. More INFO at example[.]com/n.php?la8zvtf0u
- T091 · Australia · parcel or delivery · Scamwatch (ACCC)
Arriving today: your (d08) Amazon {s7} package. More info at example[.]com/n.php?ps7gxif4s
- T103 · Australia · bank, card or payment · Scamwatch (ACCC)
Ubank: a fraudulent attempt made on card for Uber Eats has been flagged as fraud on your card ending in XX8010 if this was not you reply back NO
- T104 · Australia · parcel or delivery · Scamwatch (ACCC)
Hi S DoorDash support connecting, unfortunately your KFC order/delivery was reported in the system because the person who placed that order used someone else's card to make the payment and that is against the policies of DoorDash. Don't worry about the delivery of this order. I will be deleting this order from your screen so that you can recieve the payment.
- T105 · Australia · job offer · Scamwatch (ACCC)
Sorry to bother you! I'm Amelia from <redacted>. We recommend a full time/part-time employee job for you, with an hourly salary of 50-200 Australian dollars! Conduct internal testing for some companies' online apps. The work is easy, and you can work 1 to 2 hours each time, and you can obtain a work permit at least 5 times a week. Please note that you must be over 22 years old for this job. If you are over 22 years old and would like to apply for this job, please reply "Yes" or "Interested".
53 typical examples written by the publishers
- T002 · United States · parcel or delivery · United States Postal Service (USPS News)
The package has arrived at the warehouse and cannot be delivered due to incomplete address information. Confirm your address at the link.
- T003 · United States · parcel or delivery · United States Postal Service (Postal Bulletin 22607)
USPS: the scheduled delivery for parcel XXXX has changed. Please confirm here [link].
- T011 · United States · parcel or delivery · Verizon
Your package has arrived but could not be delivered. Please click to confirm your address.
- T012 · United States · bank, card or payment · Union Bank (Union Bank & Trust, Michigan)
We’ve detected unusual activities on your debit/credit card. Please verify these immediately at (fraudulent link).
- T013 · United States · bank, card or payment · Union Bank (Union Bank & Trust, Michigan)
We’ve noticed unusual activities on your account. Please verify/change your password at (fraudulent link).
- T014 · United States · bank, card or payment · Union Bank (Union Bank & Trust, Michigan)
Your debit card has been temporarily locked because of unusual activities. Please verify your card number and PIN to reactivate your card (fraudulent link).
- T015 · United States · bank, card or payment · Union Bank (Union Bank & Trust, Michigan)
A transaction of $1,000 with (name of merchant) has been flagged as suspicious.
- T016 · United States · bank, card or payment · Union Bank (Union Bank & Trust, Michigan)
Union Bank: Important security update! Tap here to install/activate our new security feature (fraudulent link).
- T017 · United States · bank, card or payment · Union Bank (Union Bank & Trust, Michigan)
We’ve noticed unusual activities with your account and sent you a one-time passcode. Please reply with the code so we can secure your account.
- T018 · United States · bank, card or payment · Union Bank (Union Bank & Trust, Michigan)
I sent you $500 by mistake. Could you please send it back to me? Thanks!
- T019 · United States · bank, card or payment · M&T Bank
M&T Bank Fraud Alert: Did you authorize a $1,950 transaction? Reply YES or NO.
- T020 · United States · toll, parking or traffic fine · M&T Bank
Final Notice: Your toll payment is overdue.
- T027 · United Kingdom · bank, card or payment · HSBC UK
HSBC: A payment was attempted from a new device. If this was not you, please visit hxxp://security-unverifiedpayee[.]com/hsbc
- T028 · United Kingdom · bank, card or payment · HSBC UK
ID931: Your direct debit RVX FINANCE added successfully. Allow 24 hours to view online. Call HSBC 033004-348-67 if you did not request after this.
- T029 · United Kingdom · parcel or delivery · HSBC UK
We attempted to deliver your package at 19:05 on Thursday 20th July 2023 but no one was available. Your parcel was returned to our depot. Pay to reschedule you redelivery by pressing here hxxp//:bit[.]ly/2jh.1nuk.
- T030 · United Kingdom · bank, card or payment · HSBC UK
Your H.SBC car was used on 20-07-23, 12:20:40, at B&Q for £2491. If you do not recognise this transaction call us on 033002245906.
- T031 · United Kingdom · bank, card or payment · NatWest
WARNING we’ve noticed some suspicious activity on your account. For your security, your account will be suspended if you do not get in touch. Click this link to contact our fraud team.
- T032 · United Kingdom · bank, card or payment · NatWest
A withdrawal of £1566.04 has been made from your account. If this wasn’t you, please call the fraud team on XXXX XXX XXXX immediately.
- T033 · United Kingdom · bank, card or payment · NatWest
Our security team need to speak with you urgently. Your bank account was accessed at 14:35PM. If this wasn’t you, please call our fraud team immediately on XXXX XXX XXXX.
- T034 · United Kingdom · bank, card or payment · NatWest
An unknown device has just been used to log into your bank account. Your account may be at risk. Please visit www[.]afakelink[.]com to secure your account immediately.
- T035 · United Kingdom · bank, card or payment · NatWest
Someone tried to access your account today, but thankfully we stopped them in time. To protect you we’ve put a temporary block on your account. All you need to do is use this secure link to log in: www[.]afakesite[.]com. Just follow the helpful steps to unlock your account and reset your password. Report anything suspicious to us straight away. Together we can fight fraud.
- T036 · United Kingdom · bank, card or payment · Nationwide Building Society
Your Nationwide Debit Card has been temporarily deactivated to prevent fraudulent payment to John Lewis for 2562.00 GBP. Please call Fraud Prevention immediately on 03330220339 if you are not aware of this transaction. Do not reply by SMS
- T041 · United Kingdom · parcel or delivery · Royal Mail Group
Your item intended to arrive tomorrow is now returned to our local facility. Visit [website] by [date]
- T042 · United Kingdom · parcel or delivery · Royal Mail Group
Your item is at our warehouse, where it will be held until [date]. Visit [website].
- T043 · United Kingdom · parcel or delivery · Royal Mail Group
Your item due to arrive tomorrow has been sent back to our handling facility. Visit [website] by [date].
- T054 · Ireland · parcel or delivery · Bank of Ireland
Your parcel is ready for delivery. Please pay the outstanding charge on this link —-
- T055 · Ireland · government payment, tax or benefit · Bank of Ireland
You’ve been a close contact of someone with Covid. Please follow the instructions here to order a test —–
- T070 · Canada · government payment, tax or benefit · Canadian Anti-Fraud Centre
A one-time $500 payment due to inflattion with housing costs is now eligbl to you. Reply Y to obtain.
- T071 · Canada · toll, parking or traffic fine · Competition Bureau Canada
Unpaid highway toll detected on your vehicle. Pay now to avoid fines.
- T072 · Canada · bank, card or payment · Competition Bureau Canada
We’ve detected suspicious activity on your account – verify now
- T073 · Canada · government payment, tax or benefit · Get Cyber Safe (Government of Canada)
Hello. Your SIN has been compromised. Please click the link to verify your identity.
- T074 · Canada · parcel or delivery · Get Cyber Safe (Government of Canada)
Please click the link to track your packages! Enter your Password and SIN Here to access your mail tracking account.
- T075 · Canada · parcel or delivery · Get Cyber Safe (Government of Canada)
Verify your SIN to receive your delivery.
- T076 · Canada · parcel or delivery · Get Cyber Safe (Government of Canada)
Urgent request from your mail carrier!!
- T077 · Canada · parcel or delivery · Get Cyber Safe (Government of Canada)
Reply with your password and SIN to access your tracking account. Thx!
- T078 · Canada · parcel or delivery · Get Cyber Safe (Government of Canada)
Please click the link to track your package! Enter your Password and SIN Here to access your mail tracking account. Thx!
- T079 · Canada · parcel or delivery · Government of Alberta (Cyber Alberta)
We could not deliver your parcel. Pay a small fee to reschedule
- T080 · Canada · bank, card or payment · Government of Alberta (Cyber Alberta)
Your account has been locked. Verify your identity now.
- T081 · Canada · government payment, tax or benefit · Government of Alberta (Cyber Alberta)
You are eligible for a rebate. Claim your payment today.
- T082 · Canada · toll, parking or traffic fine · Government of Alberta (Cyber Alberta)
Final notice: pay now to avoid additional charges.
- T083 · Canada · family or friend · Government of Alberta (Cyber Alberta)
Hey, I need you to send money right away, I’m in trouble.
- T084 · Canada · family or friend · Competition Bureau Canada
Hi, it's John. I'm back! When are you free to catch up?
- T092 · Australia · bank, card or payment · Telstra
FROM BANK: There has been a login attempted from a new device. If this was NOT you, please call us urgently on <scam phone number>
- T093 · Australia · bank, card or payment · Telstra
BANK: You have successfully scheduled a transaction of $799.99 to payee <name> on 18/11/22. If this was NOT you, urgently contact us on <scam phone number>
- T094 · Australia · toll, parking or traffic fine · Telstra
Linkt.:Your e-tag payment has been overdue on October to avoid fine charge please visit: <malicious website>
- T095 · Australia · bank, card or payment · Telstra
#Payment-Alert: You've paid A$2599.99 from your Bank Account info: PayPal TXN#401XVR15tq93 on 2021/11/11, If any Dispute, Dial us: < scam phone number > Thank you!!
- T096 · Australia · phone carrier or reward · Telstra
Congratulations! You were lucky. You have been chosen among 100 thousand people. You won a new iPad from us. hxxp://tiny.url/notreal
- T097 · Australia · threat or extortion · Scamwatch (ACCC)
Someone paid me to kill you. If you want me to spare you, I'll give you two days to pay $5000. If you inform the police or anybody, you will die, I am monitoring you.
- T098 · Australia · family or friend · Scamwatch (ACCC)
Please call me back right away. It is an Emergency I need your help!
- T099 · Australia · voicemail or notification · Scamwatch (ACCC)
ab12c3 Nfw voice message received
- T100 · Australia · voicemail or notification · Scamwatch (ACCC)
gh6tr7 Voicemail message received
- T101 · Australia · voicemail or notification · Scamwatch (ACCC)
x78y9z New oozce-message received
- T102 · Australia · family or friend · South Australia Police (SAPOL)
Hi Mum, I lost my phone and this is my new number…
The warning you remember is the loud one. The text that gets people is quieter: a small refund, a tidy reference number, a reasonable deadline, and a polite request to reply Y. Judge a text by what it asks you to do, not by how it sounds.
Questions about scam texts
What does a scam text look like?
In the 52 real scam texts we verified at source, 42 asked you to tap a link, 16 dressed up as official paperwork with case numbers, legal codes or office names, and every sum of money named was 620 or less in its currency. Most sums were money offered to you, such as a refund or benefit. The examples written for official warnings were shorter and named much bigger sums.
Why does a scam text tell me to reply Y and reopen it to activate the link?
5 of the 52 real texts in our corpus did this. The texts themselves give the reason: replying, then reopening the message, is what makes the link clickable. Whatever messaging app you use, a genuine agency or company never needs you to reply before its link works. Do not reply. Delete the text and report it.
Do scam texts use your name?
Rarely, in our corpus: 1 of the 52 real texts addressed the recipient by name, and only by an initial. Most used no greeting or a generic one such as Dear Customer. Some scams do use names taken from leaked data, so a name proves nothing either way. Judge the request, not the greeting.
Are scam texts always full of spelling mistakes?
Some are. Our corpus includes Departmet of Licensing and a parcking penatly charge. But many real scam texts in it are written cleanly, including bank alerts and parcel notices. Good spelling proves nothing, and a text can be perfectly written and still be a scam.
What should I do with a scam text?
Do not tap the link and do not reply. Forward the text to 7726, a free reporting shortcode supported by the major carriers in the United States, the United Kingdom, Canada and Ireland (in Australia, use 7226), then delete it. If you already tapped and entered details, contact your bank straight away using the number on your card or in its app.
Where do the texts in this corpus come from?
From 32 publishers on 41 pages: regulators, police forces, courts, government departments, banks, phone carriers and postal operators in the United States, the United Kingdom, Canada, Australia and Ireland. Each text was checked word for word on the publisher's own page on 30 October 2026. 52 are captured messages from real campaigns and 53 are the publishers' own typical examples.
Sources and review
Every text was read and matched word for word on its publisher's page on 30 October 2026; the source page for each text is linked beside it in the corpus above and in the dataset. Publishers include the FBI Internet Crime Complaint Center, the Alabama Department of Revenue, Clark County District Court, the Superior Court of California for Calaveras County, the Maryland Attorney General, the US Postal Service, the Driver and Vehicle Standards Agency, Royal Mail, Take Five, HSBC UK, NatWest, Nationwide, Bank of Ireland, the Competition and Consumer Protection Commission, the Canadian Anti-Fraud Centre, CIBC, the Competition Bureau Canada, Get Cyber Safe, the Government of Alberta, Scamwatch, Telstra and South Australia Police. Coding and analysis are ours. This is general information, not legal or financial advice.