Got a Text From Your Own Number? UK Scam Texts Explained

A text that appears to come from your own mobile number is a scam. Your phone hasn’t sent it and, in almost every case, your phone hasn’t been hacked. The sender has been faked, and the confusion is the point: people tap the link to find out what’s going on.

This is one version of “smishing”, which is phishing by SMS. Here’s how it works, what scam texts in the UK typically look like and what to do with them.

How a text can appear to come from you

A text message carries a sender number or name, and the sender can choose what goes there. Bulk messaging services and internet-based texting tools let senders set any number or name, and criminals use that to pretend to be your bank, a delivery company or, in this case, you. Because your phone groups messages by sender, a fake can even land in the same thread as genuine messages from that sender.

Some criminals go further. In 2024 police arrested two men who had used a home-made phone mast, known as an “SMS blaster”, to send thousands of texts posing as banks and other official organisations. The device bypassed the systems mobile networks use to block suspicious messages.

Help is coming. In July 2026 Ofcom set new rules requiring mobile networks to block scam texts in transit and to stop fake sender names on business messages, with the first rules taking effect in January 2027. Mobile operators already block an estimated 600 million or more scam messages a year, but some still get through.

Why scam texts work

Texts feel more personal and urgent than email. On a phone you can’t easily see where a link goes, links are often shortened, and there’s no email address to check. You’re also more likely to be on the move and acting quickly.

Scam texts doing the rounds in the UK

The details change every few weeks, but the patterns don’t:

• A parcel you need to pay for. A small “redelivery” or customs fee, on a page that takes your card details.
• A tax refund. HMRC says it will never tell you about a tax refund or ask for personal or payment information by text. Forward HMRC-themed scams to 60599.
• A problem with your bank. “A new payee has been added. If this wasn’t you, call us on…” The number goes to a criminal pretending to be your bank’s fraud team.
• A family member with a new number. “Hi Mum, I’ve broken my phone, this is my new number”, followed by an urgent request for money.
• An unpaid fine or bill. Parking, tolls or a utility bill, always with a deadline.
• A message from the boss. At work, a text that appears to be from a director asking for gift cards or an urgent payment. Our guide to phishing and email scams has more on this one.
• Your account will be locked. A link to a fake Microsoft 365 or Apple sign-in page.

What to do with a scam text

1. Don’t tap the link and don’t reply, not even “STOP”.
2. Forward it to 7726. It’s free on most UK networks. On an iPhone, press and hold the message, tap More, then the arrow, and send it to 7726. On Android, press and hold the message, tap the three dots, then Forward.
3. Delete it.
4. If it mentioned a real organisation, contact them using details you already have, not the number in the text.

If you’ve already tapped and typed something in:

• Card or bank details: call your bank straight away on the number on your card, or dial 159 to reach most UK banks safely.
• A password: change it, and change it anywhere else you use the same one. If it’s a work account, tell your IT support now.
• Money lost: report it to Report Fraud (England, Wales and Northern Ireland) or Police Scotland on 101.

Protecting phones used for work

Most staff now read work email and approve sign-ins on their phones, so a scam text can be a way into the business. A few things reduce the risk:

• Keep phones updated and set to install updates automatically.
• Use an authenticator app or passkey for work sign-ins rather than codes sent by text.
• Filter web traffic on work phones, so known scam sites are blocked even if someone taps a link.
• Talk about scam texts in training, including the ones that come “from yourself”.

Our cyber security service includes DNS filtering and security awareness training. For a wider checklist, read how to keep business mobile devices secure, and for the QR code version of this scam, see our guide to quishing.