A text arrives saying your parcel is held at customs, or your bank account is locked, or someone "found your photos". Most people do one of two things: tap the link out of curiosity, or fire back a reply asking who it is. Both happen within seconds, and both are fixable if you move calmly. Here's a practical order of operations for the ten minutes after a suspicious message.
Minute one: stop interacting
Don't reply, don't tap anything else, and don't call the number in the message. A reply, even "STOP" or "wrong number", tells the sender that your line is active and read by a real person, which tends to bring more messages. This guide on what happens if you reply to a scam text explains why a single answer can move your number onto better-paying lists.
Minutes two to five: if you already tapped the link
Tapping a link isn't automatically a disaster. What matters is what came next:
- You only opened the page. Close the tab, clear recent browser history, and don't go back to it.
- You typed a password. Change that password now from the official app or site (not from the link), and change it anywhere else you reused it. Turn on two-step verification.
- You entered card or bank details. Call your bank using the number on the back of your card and ask them to block the card.
- You installed something. Uninstall it, run Play Protect, and check which apps have accessibility or device-admin permissions.
There's a longer checklist for this situation in what to do after clicking a link in a scam text.
Minutes five to eight: report and block
Forward the message to your carrier's spam short code where one exists (7726 in the US and UK), then block the sender and delete the thread. Reporting helps carriers filter the same campaign for other people, and blocking keeps the next variant out of your inbox.
Minutes eight to ten: reduce what's exposed next time
Scam texts land because your number is already out there: on old sign-up forms, marketplace listings, delivery apps and data-broker sites. A few habits shrink that footprint over time:
- Give your main number only to people and services that truly need it.
- Use email instead of a phone number for one-off sign-ups wherever it's offered.
- When you need to send a one-off text to a stranger, such as a seller or a contractor, avoid sending it from your personal line.
For that last case, Ghost is an Android app that sends an SMS without showing your real number to the recipient. It's send-only: it doesn't give you a virtual number and it can't receive SMS, replies or verification codes, so it isn't a tool for signing up to services. It's free to download from Google Play and uses in-app credits for sending. There's no iPhone version.
The short version
Don't reply, undo whatever you gave away, report and block, then share your number less. Ten calm minutes beat a week of cleaning up.