What makes a phone number itself suspicious?
Four properties, and the area code is not one of them.
The first is the line behind the digits. A number carried over the internet costs almost nothing, can be bought in bulk and can display whichever area code its buyer picked from a menu, which is the shape a disposable fraud number takes.
The second is age and history. A number attached to accounts registered years ago is a different object from one that appeared last week with nothing behind it at all.
The third is reuse. The same digits sitting under a dozen unrelated classified listings, or named in complaint threads, have been used before and somebody has already said so.
The fourth is the one that settles most cases: whether the number belongs to the organisation the message claims it does. That is checkable in about a minute, and the two sections after the next one are how.
Where the number reached you from is half the evidence
A number you went and found is not the same evidence as a number that arrived on its own.
If you typed it off the back of your card, read it from a contract already in your hand, or found it on the organisation's own site, the channel vouches for the digits. Nobody chose to put them in front of you.
A number that arrived unsolicited was selected by whoever wants it dialled — in a text, a marketplace message, an email signature, a recruiter's WhatsApp. That is true whether or not the sender is dishonest, and it is why identical digits deserve different weight in the two cases.
The channel is part of the claim. The first question is not whether the number is bad. It is who put this number in front of you, and whether you asked them to.
Does the number belong to the organisation it names?
Frequently it cannot, and that is checkable rather than a matter of judgement.
Ofcom and UK Finance keep a Do Not Originate list of numbers an organisation uses to receive calls and never to make them — the example Ofcom gives is the number on a bank card, reserved for customers reporting problems. Any outgoing call appearing to come from one of them, in Ofcom's words, will have been spoofed.
The list is shared with telecoms providers so those calls can be blocked, and Ofcom names the limit in the same breath: not every provider applies it, and technical constraints mean a small number of calls still connect.
Your version is shorter. A call displaying the number printed on your card is not your bank ringing you, because that number does not ring anybody.
The number in the message is the one part of it the sender chose. The number on the back of your card is the one they could not.
How should you call a bank or courier back?
On a number you already held, and never on the one that contacted you.
The FTC's advice for an unexpected call claiming your money is at risk runs to three steps: get the basic details, hang up, and verify the story by contacting the company yourself. It names the routes it trusts, which are the official app or website and the number on a recent statement or the back of the card.
It also names a route that fails, which most guides leave out. Do not rely on top search results for a company's number: scammers buy paid search ads so their fake ones sit at the top of the listing.
And no legitimate fraud department asks you to keep the call secret. That instruction exists to prevent the one check that catches this.
Four messages, one shape
The stories rotate; the mechanism does not. Each wants one small action, and the action is the product.
| The message | What it wants | The tell |
|---|---|---|
| A delivery or customs fee | Card details on a lookalike site | Couriers bill the sender, not a link |
| A bank fraud alert | That you ring the number in the text | The card number never dials out |
| A wrong number, then friendliness | A conversation, later an investment | An apology that keeps talking |
| A job offer quoting a daily rate | A reply, then eventually a deposit | No employer recruits by cold text |
The FTC files the first three under one alert on unexpected texts, and the wrong-number opener that turns friendly is the first move of a pig-butchering scam.
The bank alert is the expensive one. The FTC reported $3.5 billion lost to imposter scams in 2025, nearly one fraud report in three, and says the costliest start with a fake security alert, often from a bank.
Is a job offer from an unknown number ever real?
Not one that arrives cold on your phone.
The FTC's alert on fake recruiter texts describes messages naming a company you would recognise, offering remote work at a daily or weekly rate, and giving no detail about the work itself. The twist it flags is that instead of a link, you are asked to reply YES or INTERESTED, because the reply is the thing being harvested.
Two endings follow. A cheque you are asked to deposit and partly send back, or a run of small online tasks that eventually require your own money to continue.
The rule is worth keeping in the FTC's own words. Ignore generic and unexpected texts, WhatsApp or Telegram messages about jobs, and never pay to get paid.
What does looking the number up settle?
The shape of the line, and nothing about the intent behind it.
Four fields come back: whether the line is dialable at all, who carries it, what kind of line it is, and which public accounts were opened with it. The guide to reverse phone lookups sets out where each is read from, and why the region cannot be forged the way the caller ID can.
Two of them do real work in this decision. A number holding accounts opened years ago belongs to somebody with a past; a working internet-carried line with nothing attached is consistent with digits bought for a single campaign.
Neither finding is a verdict on its own. Both change how much weight the rest of the evidence has to carry, which is the honest description of what any single check does.
Why a clean result is weak evidence
Because what a fraud number lacks is history, and a brand-new honest number has none either.
The phone module here reaches 8 sources, against 71 for an email address, and that gap is published rather than hidden. Numbers are not written down in the open the way handles and domains are, so a sparse report is the ordinary outcome and not in itself an alarming one.
A small business that moved to an internet telephony provider last month returns the same near-empty report as a line bought for one run of texts. The report cannot separate them, because on the evidence it holds they are the same object.
Which is why the checks here are ordered as they are. Provenance and the organisation-match settle cases that a lookup on its own leaves open.
What should you do before you reply?
Nothing that confirms the number reached a person.
A reply of any kind tells the sender that the line is live and read — STOP, a correction, a single character. The FTC's guidance on unwanted text messages is to reply to none of it, click no link, and check the story with the organisation on a number or website you already know is real.
Then dispose of it rather than argue with it. Use the phone's report-junk option, or forward the message to 7726, which is how your provider learns to filter the next batch.
If the number rang rather than wrote, what to do about an unknown caller is a different sequence. The one thing both share is that engaging is the only move that costs you something.
Common questions
How can I tell if a phone number is a scam?
Check four things: the line type behind it, whether it has any history, how it reached you, and whether it really belongs to the organisation named in the message. An unsolicited number that asks to be dialled and creates urgency is the pattern fraud takes. None of the four is proof on its own, and together they decide most cases.
Is it safe to call back a number from a text message?
No, as a default. The number in the message is the part the sender chose, so dialling it tests nothing. If the message claims to come from a bank, courier or tax office, reach that organisation through its own app, its published site, or the number on a statement or the back of your card, and let them tell you whether the message was theirs.
How do I check whether a number really belongs to my bank?
Compare it against the contact number the bank publishes itself, on its app or its own website. Do not use a search result, because the FTC warns that scammers buy paid ads so fake numbers appear at the top of a listing. Where the number on your card is reserved for inbound calls, it will never be the one ringing you.
Can a scammer make a call show my bank's real number?
Yes. Caller ID carries no proof of origin, so the displayed number can be set to anything. Ofcom and UK Finance maintain a Do Not Originate list of inbound-only numbers, such as those on bank cards, so providers can block calls spoofing them. Ofcom states that not all providers apply the list and some calls still connect.
Is a text about a delivery fee ever genuine?
Almost never in that form. A courier bills the sender or collects at the door rather than sending a link for card details, and a customs charge is raised against a shipment you can look up on the retailer's own order page. The FTC lists fake delivery notices among the commonest text scams, alongside unpaid tolls.
Should I reply STOP to a scam text?
No. Any reply confirms that the number reached a live handset read by a person, which is worth money on a list that gets resold, and STOP only obliges genuine marketers. Delete the message, use the phone's report-junk option, and forward it to 7726 so your provider can filter similar messages later.
Are job offers sent by text or WhatsApp real?
Not the unsolicited ones. The FTC's advice is to ignore generic and unexpected texts, WhatsApp or Telegram messages about jobs, because real employers do not recruit that way. The messages name a known company, quote a daily rate, describe no actual work, and end in a fake cheque or a task scheme that asks for your own money.
What does it mean if the number is registered to WhatsApp or Telegram?
That somebody signed the number up on a service that accepts a phone number as a login. It shows the line has been in use rather than bought yesterday, which is mild reassurance and no more. Accounts on messaging apps are created in seconds, so their presence dates the number rather than identifying the person holding it.
Does a clean lookup mean the number is safe?
No. A clean result usually means no public history exists, and a number bought last week has none to find — but neither does an honest new business line. The phone module reaches 8 sources against 71 for an email address, so a thin report is the ordinary outcome and carries little weight either way.
What should I do with a scam text once I have spotted it?
Do not reply and do not open the link. Report it through the messaging app's junk option, forward it to 7726 so your provider can filter the next batch, and report it to the FTC at ReportFraud.ftc.gov in the United States. Then block the number, while expecting the next message to arrive from a different one.
