Is this text a scam? How to spot fake bank, parcel, toll and fine messages

If a text asks you to tap a link, call a number or share a code to pay, unblock or claim something, treat it as a scam until you have checked it yourself. Do not use the link or the number in the message. Open your bank’s app, the courier’s website or the official site of the office it names, and look there. The US Federal Trade Commission gives the same advice: use a phone number or website you know is real.

Anyone can be fooled by these messages. They copy logos and wording, and some even appear in the same conversation as real texts from your bank or courier.

What are the signs that a text is a scam?

The UK’s National Cyber Security Centre (NCSC) lists tricks scammers use, among them: they pose as someone official, they rush you, they play on fear or hope, and they send messages you were not expecting. In texts, that usually looks like this:

It wants something now. Pay today, avoid a penalty, unblock your card before midnight. The Italian Polizia Postale warns that fake fine texts ask for payment within very short deadlines.
It asks for a code, a PIN, a password or card details. No bank asks you to enter or share your personal or bank details by text, email or phone, the Polizia Postale reminds people.
It sends you to a link or a phone number. The Polizia Postale lists suspicious or shortened links among the signs. In Italy, numbers that start with 892 or 893 are premium-rate lines.
It comes from an unknown foreign number while claiming to be a company in your country, another sign on the same Polizia Postale list.
You were not expecting it. No parcel on the way, no toll road last week, no refund pending.

The name at the top of the message is not proof. Nexi, an Italian card company, explains on its security page that a fake text can look as if it came from your bank or from Nexi and appear in the same list as the official messages. Its rule: if the sender wants a one-time code, a password or other secret information, it is a scammer.

No single sign proves anything, and a fake text can show none of them: the check that settles it is the one you do yourself.

Which fake texts are the most common?

Our examples below show the pattern; they contain no working links or numbers.

“Payment pending” or “card blocked”: fake bank and card texts

Card security: a payment of EUR 1,249.00 is waiting for your approval. Not you? Call [a mobile number] now to block it.

A text warns of a suspicious payment, a blocked account or a new device connected to your account. The Polizia Postale describes a two-step version: a text, then a call from a fake bank employee or even a fake police officer who offers to “protect” your savings. In another version, the fake employee proposes moving your money to a “safe account”. In the US, the FTC said in June 2023 that the most-reported text scam looked like a fraud alert from your bank and asked people to call a number or reply “yes” or “no” about a large purchase they had not made.

Nexi, whose name some of these texts use (its security page describes fake texts from senders that look like Nexi), says it never asks for your card details, PINs or codes by phone, email or text, and never asks you to make a transaction with your card. It is not involved in these messages. Check your card in your bank’s app or call the number printed on the back of the card.

“Your parcel is waiting”: fake delivery texts

Your parcel could not be delivered: the house number is missing. Update your address within 24 hours: parcel-redelivery[.]example

The Polizia Postale has described a fake courier text that lands in the same chat as the courier’s real messages, with a link to “pickup instructions”, followed by a call from someone posing as the delivery driver who asks for more payments. The caller’s number can be faked. In the US, the Postal Inspection Service says USPS does not send texts unless you asked for them with a tracking number, and those texts do not contain a link.

Track a parcel with the tracking number in your order confirmation, on the shop’s or the courier’s own website or app. If someone calls about a delivery, the Polizia Postale advises checking with the delivery company directly.

“Unpaid toll” and “unpaid fine”: fake road charges

FINAL NOTICE: an unpaid motorway toll of EUR 6.40 is registered to your vehicle. Pay today to avoid a EUR 48 penalty: toll-payment-portal[.]example

In the US, the FBI warned in April 2024 about texts claiming unpaid tolls, with a small amount, a threatened late fee and a link to a fake toll website. The FTC said in January 2025 that scammers were posing as tolling agencies across the country, and may also collect details such as your driver’s license number. In Italy, the Polizia Postale reported in May 2026 WhatsApp messages from a foreign number using the name of Autostrade per l’Italia, the motorway operator, which is not involved.

Fines follow the same pattern. The Polizia Postale says the Polizia di Stato does not notify fines or penalties by text, messaging apps or links sent to phones. Fake payment requests also use the name of pagoPA, Italy’s public payment system, by email, text and messaging apps, sometimes with a QR code. In the UK, the Department for Transport warned in July 2025 about texts asking people to pay traffic fines that it did not send.

Check what you owe by logging in to your toll account or the authority’s official website, which you open yourself.

“You have a tax refund”: fake tax office and pension texts

Revenue office: you are owed a tax refund of EUR 328.45. Confirm the card you want it paid to by tonight: refund-check[.]example

On 31 August 2026 Italy’s Agenzia delle Entrate warned about texts promising an income tax refund. The fake site asks for your tax code, shows a credit of 328.45 euros, then asks for the card holder’s name, the card number, the expiry date and the security code (CVV). The Agenzia says it has nothing to do with these messages, and suggests checking any doubtful message on its “Focus sul phishing” page. Fake texts in the name of INPS, the Italian pensions and benefits office, ask you to “update your data” to keep your benefits, then ask for a copy of your ID and a selfie holding it. The Polizia Postale says INPS texts never contain links.

In the UK, HMRC says it will never send a notification of a tax rebate or ask for personal or payment information by text. In the US, the IRS says it does not send text messages without your permission.

“Call us urgently”: premium-rate numbers and the Italian CUP texts

Important communication about your medical booking. Please call [a number starting with 893] as soon as possible.

The Polizia Postale explains that texts asking you to call a number starting with 892 or 893 about “an important communication” lead to premium-rate lines. The call can cost a fee for connecting plus a price per minute: you are kept waiting for the “communication”, and at the end you are charged for the call. Official services such as the CUP (the health booking center), the ASL (local health authority) and INPS do not use premium-rate numbers. On 2 February 2026 the Lombardy region warned about texts that seem to come from “CUP offices” under made-up names such as “Centro Unico Primario” and ask people to call an 893 number.

If you are waiting for a medical appointment, call the booking center on the number published on your region’s or health authority’s official website.

How do I report a scam text?

If you are in the UK

Forward the text for free to 7726. The NCSC’s page on reporting scam texts shows how on iPhone and Android. Texts pretending to be from HMRC can also be forwarded to 60599 (charged at your normal network rate). If you lost money and live in England, Wales or Northern Ireland, report it to Report Fraud (formerly Action Fraud), the City of London Police service that replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland, the NCSC says to report it to Police Scotland on 101.

If you are in the US

Forward the text to 7726 (SPAM), use your messaging app’s “report junk” option, and report it to the FTC at ReportFraud.ftc.gov. Fake USPS texts can also go to [email protected], with a screenshot. Fake IRS texts go to [email protected] with the subject “Text” and the details the IRS lists. The FBI asks people who get fake toll texts to file a complaint at ic3.gov.

If you are in Italy

Report the message to the Polizia Postale with the Segnala online form (topic “Phishing”), then block the number. The form is a report, not a formal complaint (denuncia). If you lost money, the Banca d’Italia says you can report the crime to the Polizia Postale, at its offices or through its other channels. Nexi asks people to report texts that use its name and gives the address [email protected] on its security page. For other banks, look on their own security page.

Elsewhere

Our page on where to report a scam lists the official channels country by country.

What should I do if I only received it?

Do not tap the link, reply or call the number in the message.
Check the claim yourself in the official app or website of the bank, courier or office it names.
Report it as shown above, then block the number and delete the text. The FTC advises reporting before deleting.

What if I clicked the link or gave my details?

Act on what you did, starting with money:

You typed card details or a code, or approved a payment. Block the card now in your bank’s app or on the number printed on the card, then tell the bank what happened. For Nexi cards, Nexi says to block the card in the Nexi Pay app or by calling the number on its security page.
You typed your online banking login. Call your bank on the number on your card or in its app, then change the password.
You typed a password for another account. Change it, and change it on every other account that uses the same one, the NCSC advises. The FTC adds turning on two-step login (two-factor authentication) on that account.
You only opened the page. If you opened it on a computer or installed something it told you to, the NCSC advises running a full scan with your security software. The US Postal Inspection Service advises telling your bank if you interacted with the page, even without pressing submit.
You gave someone remote access to your phone or computer, for example through an app they asked you to install. The FTC suggests updating your security software, running a scan, deleting anything it flags and changing your passwords.

In the US, if you gave your Social Security number, the FTC points to IdentityTheft.gov.

What if I paid?

Call your bank or card company first, on the number printed on your card or in its official app, and ask them to stop or reverse the payment. Then report it to the police. By payment method:

By card. Block the card and ask for a refund. In the US, the FTC notes that federal law protects you from unauthorized use of credit and debit cards.
By bank transfer. Call at once; the same applies to instant transfers. In the UK, the reimbursement rules for scams cover ordinary UK bank transfers (Faster Payments and CHAPS) made since 7 October 2024, up to £85,000. The regulator asks you to report as soon as possible, and within 13 months of the payment.
In Italy, if the bank says no. The Banca d’Italia explains that you can send the bank a written complaint, which must be answered within 15 working days for payment services, and then go to the Arbitro Bancario Finanziario (ABF), the banking ombudsman.
By payment app. Report the payment to the app at once and ask it to reverse the payment, the FTC advises.
By gift card. Contact the company that issued the card on the number printed on it, say a scammer got the card number and PIN, and ask for a refund. Keep the card and the receipt.
In crypto. Contact the exchange or the crypto ATM operator, say the transaction was fraud and ask them to reverse it. The FTC warns that crypto payments do not have the protections of cards.
By prepaid card (such as Postepay in Italy). Our guide to the first 30 minutes after a scam covers them.

We cannot say whether your money will come back: the bank decides first, then the ombudsman or a court. Be very wary of anyone who contacts you out of the blue offering to get your money back for an upfront fee: the UK’s Financial Conduct Authority describes these recovery scams and says police fraud reports cannot be shared with private recovery firms.

Where to go next

I’ve been scammed: what to do in the first 30 minutes, if you already paid or gave your details.
Where to report a scam, country by country, with the official channels.
How to protect yourself from online scams, the complete guide.
Online shopping scams, for fake shops and the delivery texts that follow a purchase.

Common questions

What happens if I clicked on a link in a spam text?

Close the page and do not type anything into it. If you typed a password, change it, and change it on every other account that uses the same one. If you typed card details or a code, block the card now in your bank's app or on the number printed on the card. If you opened the link on a computer or installed something it told you to, the UK's NCSC advises running a full scan with your security software.

How do I report a scam text in the UK?

Forward it for free to 7726, the scheme most UK phone providers run; the NCSC explains how to do it on iPhone and Android. Texts that pretend to be from HMRC can also go to 60599 (charged at your normal network rate). If you lost money, report it to Report Fraud (formerly Action Fraud) in England, Wales and Northern Ireland, or to Police Scotland in Scotland.

Is the text about an unpaid toll a scam?

Very often, yes. The FBI and the FTC in the US, and the Polizia Postale in Italy, have warned about texts and WhatsApp messages that claim you owe a toll and link to a fake payment page. Check your toll account on the toll operator's official website or app, which you open yourself, never through the link.

Is the USPS text message real?

The US Postal Inspection Service says USPS does not send texts unless you asked for them with a tracking number, and that those texts do not contain a link. A USPS text with a link that you never signed up for is a scam. You can send it to [email protected] and forward it to 7726.

Is the Nexi text about a payment authorization a scam?

Treat it as one. Nexi says it never asks for card details, PINs or codes by phone, email or text, and never asks you to make a transaction with your card. Check your card in the Nexi Pay app, and if you shared a code or card details, block the card in the app or on the number Nexi publishes on its own site.

What is the CUP 893 text scam?

It is a text that asks you to call a number starting with 892 or 893 about an important communication. It pretends to come from the CUP, the health booking office, often under a made-up name such as 'Centro Unico Primario'. These are premium-rate numbers: you wait on hold and pay for the call. The Polizia Postale says official services such as CUP, ASL and INPS do not use premium-rate numbers.

Topics: scams, scam texts, smishing, phishing