What are the warning signs in a text message?
A scam text tries to make you act fast: it creates a sense of urgency, then pushes you towards a link or asks for information nobody should ever request by message.
This is also known as SMS phishing, or "smishing". No single sign is proof on its own; it's when they pile up that you should stop.2
- Urgency or fear. "Final reminder", "before tonight", "surcharge", "account suspended", "parcel on hold": the message wants you to act before you think. A genuine organisation gives you time to check.
- An unexpected link. A domain you don't know, or one that copies an organisation's address with a single letter changed. A short link isn't suspicious in itself: what should worry you is an address the organisation doesn't normally use, in a message you weren't expecting.
- A request for a code, a password or bank details. No serious organisation asks for these by text. And a verification code you receive by SMS is never to be shared with anyone, not even someone claiming to be your bank.
- A sender posing as a public body or a big company. Fines, tax, deliveries, banks, phone companies: scammers pick the organisations everyone expects to hear from one day. The name or number displayed proves nothing on its own.
- An offer too good to be true, an unexpected refund. A gift to claim, money to recover, a prize from a draw you never entered: the bait replaces the threat, but the trick is the same.
- Mistakes and vague wording. "Dear customer", no case reference, clumsy spelling, random capitals. Their absence isn't reassuring, though: some scam texts are very well written.
What does a scam text look like?
A short message with no organisation name, announcing a problem and giving a link to sort it out right now.
Take the message from the exercise above: "Unpaid traffic fine notice. Settle it before tonight to avoid a surcharge", followed by a link. It ticks every box:
- no organisation name, neither as the sender nor in the text;
- a threat and a very short deadline;
- a link to a website you don't know;
- and next, a page asking for your bank card, then for the code you receive by text.
A recognisable text from an organisation, by contrast, carries a consistent sender ID, the organisation's name up front, a reference you know and a number to check with.
What should you do with a suspicious text?
Don't tap, don't share anything, and check with the organisation through a channel you found yourself.
- Don't tap the link, don't reply.
Not even "just to see": the link takes you exactly where the scammer wants you.
- Don't share anything.
No code, no password, no bank details, no copy of your ID.
- Check through the organisation's usual channels.
The number on your bill or card, the website you type in yourself, the counter. Never the number or link in the message.
- Report the message.
In 2026, the Government of New Caledonia advised reporting these texts on cybermalveillance.gouv.fr and internet-signalement.gouv.fr.1 3
- Delete it.
After keeping a screenshot, if you plan to file a complaint.
Already tapped, or already typed something in?
- You haven't typed anything: close the page and go no further.
- You gave your bank card details: call your bank straight away to have the card blocked, then keep an eye on your statements.2
- You gave a password: change it immediately, and on every service where you used the same one.2
- In every case: keep the message as evidence and file a complaint with the police or gendarmerie.2
Businesses: how do you stay identifiable?
By always looking the same, and by never asking by text for what a scammer would ask for. The more stable the markers in your genuine messages, the easier it is for your customers to spot an imitation.
A sender ID in your name, always the same
A sender ID appears in place of a phone number, in 10 characters or fewer. In New Caledonia, it is registered with the local operator before use, and it must belong to you: your brand or your trading name. Keep the same one from one send to the next, without switching to a mobile number in between.
The organisation's name at the start of the message
"Example Store: …" rather than "Hello, …". If the phone's preview cuts the text short, the first words are the ones that stay visible.
Links on a recognisable domain
Always use the same addresses: your website's, or the same short domain in every send, which you tell your customers about. Only send a link when it's expected: a survey after a visit, a letter you announced, an order in progress.
Never a code, a password or bank details by text
That's the rule to remember for your customers. If you offer online payment, do it in a message they're expecting, for an invoice or a due date they know about, with your name first, and always leave them another way to pay.
Tell your customers what you never send
On your website, on your invoices, at the counter, and in the occasional text like the example above. The day a fake message goes round in your name, your customers will know it isn't from you.
A number to check with
Nobody can reply to a sender ID. Include a phone number in your important messages: it gives a customer with doubts a simple way to check.
In SMS PRO: customers can't create a sender ID on their own: it is registered for you with the operator, then checked with a real send before your first text. A sender ID registered for you
For the other markers of a well-made send, from number formats to sending times, see the guide to sending SMS in New Caledonia; for sender identification in marketing messages, see the regulations.
What happened in New Caledonia in 2026?
In late July 2026, the Government of New Caledonia and the national police warned the public about a wave of scam texts imitating a traffic fine notice.1
According to Les Nouvelles Calédoniennes, thousands of people in New Caledonia received messages announcing a traffic fine to be paid quickly through a link. The link led to a fake payment site designed to harvest bank card details. Victims then received a fake request for a verification code, which let the scammers get around the bank's two-factor authentication.1
According to an analysis by the French interministerial digital agency (DINUM), quoted by the government, the scammers used an off-the-shelf fraud kit sold on cybercriminal networks. Almost identical campaigns were seen in around ten countries, imitating tax authorities, phone companies or delivery services depending on the case.1
The government advised blocking your card with your bank as quickly as possible, filing a complaint, and reporting the message on cybermalveillance.gouv.fr and internet-signalement.gouv.fr.1
The lesson holds for every organisation that writes to its customers: an imitation works all the better when the genuine messages lack clear markers. The more recognisable your texts, the more a fake one stands out.
Sources
- Les Nouvelles Calédoniennes, "SMS frauduleux : un « mode opératoire sophistiqué » déployé à l'échelle mondiale" (in French), 5 August 2026.
- Cybermalveillance.gouv.fr, "Que faire en cas de phishing ou hameçonnage ?" (in French), updated 26 October 2026.
- Internet-signalement.gouv.fr, the official French platform for reporting illegal online content (in French).
Cite this guide
Journalists, teachers, organisations: you are welcome to reuse this guide, as long as you cite it like this.
SMS PRO (Pacific Consulting), How to spot an SMS scam, and stay recognisable, updated on 11 November 2026, https://www.smspro.nc/en/spot-sms-scams/
Update history
- : first published.
