High riskText Message Scams

Secure Message Text Scam

This scam texts that you have a new secure message from your bank, government, or service provider and links you to log in to read it, leading to a fake page that steals your credentials.

Quick verdict

Risk level
High risk
Scam type
Notification-lure phishing (smishing)
Main red flag
A text says you have a secure message and links you to log in to read it.
What to do first
Do not use the link. Check secure messages only in the official app or website.

What this scam usually looks like

This scam texts that you have a new secure message from your bank, government, or service provider and links you to log in to read it, leading to a fake page that steals your credentials.

Example message pattern

Example pattern — not a real report
Example pattern: 'You have 1 new secure message regarding your account. Log in to read it before it expires: [suspicious link]'

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

Red flags to watch for

  • A 'secure message' notice that links you to log in
  • Urgency that the message will expire
  • A login page that is not the official provider
  • A vague sender that does not name your account
  • A request for credentials or codes to 'read' it

What to do

  • Open the official app or website yourself to check messages
  • Contact the provider through official channels if unsure
  • Report the text and delete it
  • Enable two-factor authentication where available

If you already clicked or replied

  • Do not enter login or codes on the page
  • If you logged in, change that password immediately from a trusted device
  • Update the password anywhere you reused it
  • Review the account for unfamiliar activity

What not to do

  • Do not log in through links in 'secure message' texts
  • Do not share verification codes
  • Do not let expiry warnings rush you

Similar scams

Frequently asked questions

Do providers text links to secure messages?
Genuine secure messages are read by logging in to the official app or website, not through a link in a text. Treat such texts as phishing.
Isn't a 'secure message' safe by definition?
The wording is bait to sound trustworthy. The link leads to a fake login page, so always open your account directly instead.
I logged in through the link. What now?
Change that password right away from a trusted device, enable two-factor authentication, and review the account for unfamiliar activity.
How do I read genuine messages?
Open the provider's official app or type its address yourself, and read messages within your account.

Last reviewed: June 2026

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.