How to Spot a Scam Text Message or Email: 12 Signs You Might Easily Overlook (evergreen guide)

These days, a fraudulent text message doesn’t look like a message full of mistakes from an unknown number. It’s usually short, to the point, and appears in the same thread as messages from your bank. Here are 12 warning signs to help protect you before you click, and steps to take if you’ve already clicked.

What Is Phishing and What Is Smishing

Phishing is an attempt to trick you into revealing sensitive information (passwords, card numbers, online banking access) by having an attacker impersonate a trusted person or company. If it comes via email, it’s called phishing. If it comes via text message or a chat app, it’s smishing. According to security authorities, people trust text messages more than emails, and that’s exactly what attackers rely on.

Experts say the common thread among fraudulent messages is always the same: credibility, urgency, and context. The message looks as if it were sent by someone you know, claims to be urgent, and relates to something you’re currently dealing with (a package, a bill, a fine).

12 red flags you might easily overlook

1. Time pressure. “Within 24 hours,” “your account will be blocked,” “final warning.” Under pressure, people click before they think.
2. A link in a text message or email from an institution. Banks and government agencies do not request sensitive information via text message or email. For example, the public administration portal does not send text messages with links, and the police do not send requests to pay fines via text message—fines are sent by mail.
3. A link that doesn’t match the sender. Check the website address. Shortened links, unusual domain extensions, or addresses that look like the real one but contain a typo are red flags.
4. An unknown number, a foreign number, or a strange sender address. For emails, check the actual address, not just the displayed name.
5. A message in the “correct” thread. Attackers can manipulate the sender so that a fraudulent text message appears among legitimate messages from a bank or courier. Therefore, the thread itself is not proof.
6. A request for card information, a PIN, codes from text messages, or login credentials. A legitimate company will never ask you for your PIN or a verification code.
7. An unexpected reward, tax refund, or unclaimed package. If you haven’t ordered anything or aren’t expecting anything, this is a red flag.
8. A generic salutation. “Dear Customer” instead of your name. Be careful—scammers have learned to get around this, too.
9. Strange phrasing or errors. Grammar and style errors are still often a sign of machine-generated messages from abroad, but AI tools are making fraudulent texts increasingly polished, so the absence of errors is no guarantee.
10. A request to install an app or log in “for verification.” Especially if it’s supposed to come from an unofficial source.
11. An emotional appeal. “Mom, I have a new number; I need money.” Scammers also target parental feelings and family ties.
12. A phone call following up on a message. A fake bank or police officer calls, claiming they’re “protecting your account,” and tells you what to do. The number they call from may look official.

Typical Scenarios in Slovakia

• Package and courier: a message about an undelivered package with a delivery fee.
• Bank: A notification about a “suspicious transaction” or “blocked account” with a link to a fake online banking site.
• Fine or fee from a government agency: a demand for immediate payment. Scammers also mimic the design of official websites and, less frequently, use the names of law enforcement agencies.
• Tax refund or overpayment: An email promises money after you enter your information.
• A fake banker or police officer on the phone: the call is conducted in Slovak to appear credible and is intended to trick you into revealing personal information or transferring money.
• Relative in distress: A text message from an unknown number purporting to be from a “child.”

A five-second checklist before clicking

1. Am I expecting this message? Do I have a contract or order with this company?
2. Is the sender pressuring me to act quickly?
3. Are they asking for personal information, a code, or a payment?
4. Does the link match the company’s actual address?
5. Can I verify this through another channel (official website, app, or the customer service number on my card or invoice)?

If the answer to any of the first three questions is “yes” or to the last one is “no,” do not click on the link. Verify the information yourself: open the official app, type the address into your browser, or call the number listed on your card or contract—not the number in the message.

Did you click or enter your information? What to do right away

1. Don’t panic and act quickly. Time is of the essence when it comes to scams.
2. Change the password for the affected account (and anywhere else you’ve used the same one) from a secure device, not via a link in the message.
3. Call your bank if you entered your account or card details, or if you sent money. In some cases, the bank can block your card or payment if you contact them in time.
4. Enable two-factor authentication and log out of any unknown devices from your accounts.
5. If you’ve installed an app, uninstall it, turn off your internet connection, and have the device checked.
6. If you’ve suffered a financial loss or data breach, contact the police.

How to Report a Scam

• To your bank or other affected provider if the attacker is impersonating them.
• The police, especially if you’ve lost money or your data has been misused.
• The National Cyber Security Center SK-CERT, which provides an incident reporting form on its website. For emails, it’s better to forward the original message as an attachment rather than just a screenshot to preserve technical details.

Procedures change, so check the current reporting method on the relevant institution’s website.

How to Protect Yourself in the Long Term

• Use a password manager and a different password for each account. A password manager won’t enter your password on a fake website, which is a good warning sign.
• Enable two-factor authentication, ideally via an app or a security key, not via text message. If logging in with passkeys is available, use that instead.
• Keep your phone, browser, and apps up to date.
• Install apps only from official app stores.
• Set transaction limits and alerts with your bank for every transaction. You’ll be notified of any unauthorized payment within seconds.
• Educate your family. Agree on a rule with seniors and children: if they receive any request for money or personal information via a message, they should first call a known number.

Summary

Phishing works because it exploits speed, trust, and fear—not technical errors. If you develop a simple reflex (“I won’t click; I’ll verify through another channel”), you’ll stop most scams before they even begin. This guide will be updated, so bookmark it or send it to someone who might need it.