How do I tell a scam call or text from a real one?

More context

Scam calls and texts are the everyday face of phishing. The mechanics are the same — a stranger pretending to be someone you trust, using urgency and authority to push you into doing something — but the channel is your phone, which most people still treat as more trusted than email. That is exactly the assumption attackers exploit.

The five families that account for almost all losses:

1. The fake fraud-team call. “We’ve detected suspicious activity on your account. We need to move your money to a safe account immediately.” Real banks never say this. The “safe account” is the scammer’s.
2. The fake authority call. “This is the tax office / police / social security. You have an unpaid balance and a warrant has been issued. Pay now by gift card or bank transfer.” Real authorities never demand instant payment by phone, gift cards, wire, or cryptocurrency.
3. The delivery/payment SMS. “Your parcel could not be delivered. Pay €1.99 here.” The fee is decoy; the goal is your card number. France’s Chronopost / La Poste, the UK’s Royal Mail, the US Postal Service, DHL and Amazon are all routinely impersonated.
4. The “hi mum / hi dad” message. A new number on WhatsApp or SMS claims to be your child who has lost their phone and needs money urgently. Always voice-call the real number first.
5. The romance / investment scam. A long conversation on a dating app or social media slowly moves to a “very profitable” crypto or trading platform that is entirely fake. Often coordinated with pig-butchering crime groups; total losses are in the tens of billions globally.

The pattern they all share:

• Authority — a name you would trust (bank, government, family, big company).
• Urgency — “right now”, “before the end of the day”, “or your account will be closed”, “or you’ll be arrested”.
• A request that breaks a normal procedure — a transfer to an unfamiliar account, a code you must read out, a gift-card purchase, an app to install, a “remote-control” link.

The practical rule, every time:

Hang up. Look up the real number yourself. Call back.

That single habit defeats almost every phone scam. Caller ID can be faked. Voices can be cloned with AI from a few seconds of recorded audio (this is now real — beware of “kidnapped relative” calls that use a cloned voice). The thing scammers cannot do is intercept a call you initiate to a number you found in a known source — the back of your card, your banking app, the official website.

Additional defences:

• Never read out an SMS code. No legitimate institution will ever ask you to “confirm” by reading them the six-digit code your phone just received. That code is a 2FA code, and they are trying to log into your account right now.
• Never share your screen via “remote support” with an unsolicited caller. “Microsoft” / “Apple” / “your bank’s IT” do not cold-call to fix your computer.
• Set a family code word — a word only your real family knows, that you can ask for during any urgent-sounding call. A scammer with a cloned voice will not know it.
• Slow down. Every successful scam relies on you acting before you think. The five minutes it takes you to call back is the entire defence.

If you have been hit: tell your bank within minutes (this is the difference between recovering the money and not), report to your country’s fraud authority (in France: Pharos and your local police; in the UK: Action Fraud; in the US: the FTC), and assume any leaked personal details will be used in follow-up scams for months — see data breach.