How to Spot an AI Scam Text in 2026 (5-Second Check)
⚡ The 5-second check
- Does it demand immediate action? → Red flag.
- Does the situation match your actual life? → If not, stop.
- Is it asking you to click a link instead of going to the official site directly? → Don't click.
- Can you verify by contacting the sender a different way? → Do that first.
For years, the advice for how to spot a scam text was simple: look for bad grammar, weird spelling, and something that feels "off." That advice doesn't fully work anymore. AI has made scam messages — and even voice calls using cloned voices — sound completely normal, sometimes indistinguishable from a real person. The old checklist isn't useless, but it's no longer enough on its own. Here's the updated version, including 5 tells that still work even when the writing is flawless.
Why these messages got so much harder to spot
Smishing — phishing delivered by text message (SMS) — has overtaken email as the most common way scammers reach people, partly because texts still feel more personal and trustworthy than email. According to the FBI's Internet Crime Complaint Center, losses from these scams have grown sharply year on year as AI tools let scammers write polished, error-free messages in bulk and, in more targeted cases, clone a real person's voice convincingly enough to fool a family member on a phone call.
The 5 tells that still work — even with perfect grammar
Grammar mistakes used to be the giveaway. Now you need to look at the structure of the message, not the writing quality:
- It creates urgency. "Your account will be suspended in 24 hours," "confirm now to avoid a fee," "final notice" — legitimate companies almost never demand action this fast, because they already know urgency is the scammer's main tool.
- It references something you didn't do. A delivery you didn't order, a payment you didn't make, a loan you never applied for. If the premise doesn't match your actual life, that's the clearest signal available.
- It asks you to click instead of log in directly. Real companies rarely need you to click a text link to "verify" something — you can always open the official app or type the website address yourself.
- The phone number looks unusual. A number with 5–6 digits, or one with no obvious connection to a real business, is a giveaway scammers often don't bother disguising.
- It asks you to keep something secret. "Don't tell anyone about this transfer" is something no legitimate bank, employer, or government agency will ever genuinely ask.
What about a voice call that sounds exactly like a relative?
This is the most alarming version, and it's genuinely happening: scammers using AI to clone a familiar voice — usually from short audio clips pulled from social media — and calling claiming a relative is in trouble and needs money urgently. The voice can be convincing enough to override your instincts in the moment, which is exactly why verification has to happen outside the call itself.
The fix that actually works: agree on a family "safe word" in advance, something a caller would have no way to know. If a call ever asks for money urgently, hang up and call that person back directly on a number you already have saved — never a number the caller gives you. That one step defeats the entire attack.
The 5-second check, in order
- Does this message want me to act immediately? That alone is reason to pause.
- Does the situation it describes actually match something real in my life right now?
- Is it asking me to click a link, rather than go to the official app or site myself?
- If it claims to be someone I know, can I verify by contacting them a completely different way?
If the answer to the first three is yes and you haven't done step four yet — that's your answer. Don't click, don't reply, don't call the number in the message. Go directly to the source.
On the broader topic of digital security: setting up a passkey for your email removes the phishing risk at its root — see our passkey explainer for why this is worth doing in under a minute. And if you're on an older iPhone, our piece on the usbliter8 Boot ROM flaw explains what device-level security actually requires today.
What to do after you spot one
Don't reply, even to say "stop" — that just confirms your number is active. Delete the message, and use your carrier's or phone's "report junk" option if available. If the message impersonated a real company, report it through that company's official app or site — it helps them flag the pattern for other customers. In the US, you can also forward scam texts to 7726 (SPAM), which goes directly to your carrier's fraud team.
The honest bottom line
Writing quality tells you almost nothing about AI scam texts anymore — that gap is effectively closed. What still works is checking whether the message is rushing you, whether it matches your actual life, and whether it's asking you to skip the official channel. A few extra seconds of "how do I verify this" is the entire defense, and it still works just as well in 2026 as it ever did.
Frequently asked questions
How do you spot a scam text in 2026?
Don't look at grammar — AI has eliminated that tell. Instead: check if it demands immediate action, if the situation matches your real life, and if it's asking you to click a link instead of going to the official site. If all three are yes, it's almost certainly a scam.
What is smishing?
Smishing is phishing carried out by SMS text message. It's now more common than email phishing because text messages feel more personal and people are more likely to act on them quickly without verifying.
Can AI clone voices for phone scams?
Yes. Scammers can create convincing voice clones from short audio clips pulled from social media. The defence: agree on a family safe word in advance, and always hang up and call back on a number you already have — never one the caller provides.
Scam trend data referenced from the FBI Internet Crime Complaint Center (IC3). Forward scam texts in the US to 7726 to report to your carrier.
Driftnote Editorial Team
We analysed real smishing examples collected throughout 2025 and 2026 — including AI-generated delivery scams, fake bank alerts, and voice cloning reports — before writing this guide.