The texts behind $470 million in fraud last year.
Seven patterns cover the vast majority of scam SMS in 2026. Each one below shows the actual message (from real FTC/AARP case reports), the typical sender profile, and how Voipy Shield handles it on behalf of your facility's residents — before any link ever gets tapped.
The seven you'll see.
Ordered by 2025 FTC Consumer Sentinel reported volume. Patterns shift every 4–8 weeks — Shield's Pattern Library pushes updates monthly so the classifier stays current.
Unpaid toll / E-ZPass
The #1 smishing category right now. Targets get hit whether they've driven a toll road that week or never. Amounts are tiny on purpose ($6.99, $11.69) so it feels too small to argue with. Link downloads a credit-card harvest page that mimics the state tolling authority.
Example text
USPS / UPS / FedEx delivery
Package-held, bad-address, redelivery-fee, "package out for delivery but action required." Most people have SOMETHING inbound most of the time, so the guess lands. Link harvests credit-card data or drops malware on the tap.
Example text
.top TLD + out-of-profile carrier copy pattern-match the monthly library; message blocked.Bank fraud alert — card / Zelle / wire
"Unusual activity" on a card or Zelle account, with a fake "press Y / reply NO" prompt. Target replies → scammer calls pretending to be the bank's fraud team → talks them through Zelle'ing their money to a "safe account" (aka the scammer's). Each hit is $5K–$50K.
Example text
Wrong-number pretext ("Hi David?")
Opens as a casual chat — "Hey is this Sarah? I got your number from Linda" — and once you reply "wrong number," the scammer stays polite and chatty. Over weeks they build rapport, eventually pivot to a crypto or stock-tip "group." AARP 2026: 11M Americans 50+ targeted, $120K median loss per victim who bites.
Example text
Fake remote-job offer
"Easy part-time work from home, $400/day, Amazon Inc / Walmart / Indeed sourcing." Leads to a WhatsApp/Telegram group where you "earn" by completing fake tasks — then get asked to deposit your own money to "unlock higher-tier tasks." Recovery rate: zero.
Example text
IRS refund / tax notice
Inverse of the phone-IRS scam: instead of threatening arrest, this one offers free money. "You have an unclaimed $847 refund, verify SSN + DOB to release." The IRS communicates by mail, never text.
Example text
Amazon account compromise
"Your Amazon account has been locked / a $2,300 order was placed." Link goes to a phishing page OR the text includes a support number — call it and you're on the phone with the same scam escalation chain covered in the live demo's Amazon scenario.
Example text
How to read the sender number.
Legitimate senders and scammers use different number formats. Teach your residents the rule once and most scams become visually obvious before they read the body.
| Sender format | Legit? | Used by |
|---|---|---|
32890 — 5-digit short code | ✓ usually real | Banks (Chase/BofA/Wells), carriers, 2FA providers, authorized marketing. |
69-2632 — 6-digit short code | ✓ usually real | Same as above. Short codes are registered with carriers ($1K+/mo) — too expensive for scammers to run. |
+1 (202) 555-XXXX — US 10-digit number | ✗ if claiming to be a bank | Real banks never send fraud alerts from a regular 10-digit phone number. Always a scam if the body claims to be Chase/BofA/Wells/Citi. |
+1 (8XX) XXX-XXXX — spoofed toll-free | ✗ | Scammers spoof legit-looking toll-free numbers. Number alone isn't a tell — combined with an "urgent action" ask, it's a scam. |
+44 7XXX XXXXXX (UK), +63 (PH), +91 (IN), +234 (NG) | ✗ if contacting a US resident | International mobile prefixes sending English-language "delivery / toll / bank" texts to US numbers are scams ~100% of the time. |
email@gmail.com formatted sender | ✗ | Email-to-SMS gateway. Legitimate orgs use short codes. Any text from an email address claiming to be a bank/carrier/gov agency is a scam. |
7726 (spells SPAM) — it goes to your carrier's abuse team, free. Or file with the FTC at reportfraud.ftc.gov. Shield customers: we report automatically on your residents' behalf, with the pattern added to the next monthly Pattern Library release.
Shield blocks these SMS patterns before they ring.
Same monthly Pattern Library that backs the voice-call demo. Texts matching a signature are quarantined at the telco layer; residents see a daily summary, not the bait. Per-resident allow-list for the banks / carriers they actually use.
Pattern Library updates ship monthly to every Shield account — free tier included.