The first thing to know is that a flood of messages like this does not mean the phone itself has been hacked. More likely, her number was exposed in a data breach or pulled from a marketing database that later made its way to scammers. 

You might be surprised to know how cheap these lists are on the black market. ZeroFox, a threat intelligence company, reported last year that one seller was offering mobile numbers in bulk for about $150 for 100,000 numbers. The criminal doesn’t need more than one successful victim to make a profit. And it makes sense that data breaches are on the rise. 

The Identity Theft Resource Center says 2025 set a new U.S. record for data compromises, with 3,322 incidents, up 5% from 2024 and up 79% over five years. In the hands of cybercriminals, these numbers can be quickly become the target for a phishing attempt. Like with email phishing, generating a sense of alarm is a popular tactic. Every one of my mom’s texts included her name near the start of the message, along with a dramatic call to action.

These messages can be especially effective because they sound technical and official. A text about a security vulnerability or suspicious activity can feel much more believable than the old fake prize notice or mystery package update. It plays on a familiar fear: that you missed something important and need to fix it now. The scammer does not need a lot of information about the person on the receiving end. A live number and the right wording can be enough.

The wording of the texts matters too. Security warnings work because they create fear and urgency. If you think your phone, Apple account or bank account is in danger, you are more likely to react before you stop and think. And that is where our instincts can mislead us. In real life, danger triggers fight, flight or freeze. Online, those same reactions do not always serve us well.

Fight is the trap. It is tempting to send an angry reply or try to outsmart the scammer, but that only confirms they have reached a real person. Your number becomes more valuable as an active contact, which can lead to even more scams.

Freeze is the hidden risk. You may leave these texts sitting in iMessages because you’ve been advised not to open them. But doing nothing not only clutters your iMessages app but misses an opportunity to help protect others by reporting the message.

Flight is the move that works. Here, flight means leaving the interaction completely. Do not reply. Report the message as junk and delete it. If you want to help your carrier block similar scams, forward the text to 7726, which spells SPAM.

That advice lines up with what Apple and the Federal Trade Commission tell users to do. Do not click links in unexpected texts. Do not engage. If there is a real issue with an Apple account, bank account or other service, open the company’s app yourself or type in the web address you know is real. Apple also lets users filter messages from unknown senders and report junk in Messages. That will not stop every scam text, but it can cut down on the noise and make suspicious messages easier to spot.

It also helps to know what would make this more serious. Scam texts by themselves usually point to broad targeting, not a compromised phone. I would worry more if they were accompanied by password reset emails that were not requested, charges you do not recognize, accounts you suddenly cannot access or problems with cellular service that suggest something bigger is going on. In that case, you will need to contact all of your sensitive accounts to report a possible intrusion.

Otherwise, delete and report should do the trick. Since we did that for all of my mom’s suspicious texts, she has not received any more.

Leslie Meredith has been writing about technology for more than a decade. As a mom of four, value, usefulness and online safety take priority. Have a question? Email Leslie at asklesliemeredith@gmail.com.