Why Scam Texts Still Get Through Your Phone's Filter

Why Scam Texts Still Get Through Your Phone's Filter

It's 4:40 on a Wednesday afternoon. A text from a number you don't recognize says, "Hi, are we still on for Thursday?" There's no link. No threat. No urgent anything. Your phone, which has spam filtering, drops it in your inbox right next to your sister's texts.

That's not a bug. A message like that is built to sail past a filter. And a lot of people assume the opposite: "If it were a scam, my phone would have caught it." Look, I get why. Phones advertise this stuff. But what your phone's filter does and what you think it does are two different things, and scammers know exactly where the gap is.

What your phone's filter actually does

Let's go through what the companies say about their own tools, because it's narrower than the marketing vibe.

On iPhone, the big one is a setting you have to turn on yourself. Apple's guide says that when you screen messages from unknown senders, "their messages are filtered into another folder, and you don't get notified about them unless you want to be." You can let certain categories through, like verification codes. The wording of the setting has shifted between iOS versions, so if you can't find it, look under Manage Filtering in the Messages list.

There's a second, separate tool called Text Message Filter. Apple says it detects and filters SMS, MMS and RCS messages from unknown senders into folders for Transactions and Promotions. Note what it's for: promotions and transactions. It is a sorting tool, not a scam detector.

On Android, Google Messages does its filtering with on-device machine learning "to detect known spam patterns in your messages from unknown senders." Google says suspected spam can be kept from delivery and hidden in a "Spam & blocked" folder, and that links in messages are sent to Google for a safety check. There's also an enhanced mode that can send messages off the phone for a closer look at harder-to-spot scams.

Notice the shared theme. Both are built around unknown senders and known patterns. That's a sensible design. It's also exactly what a patient scammer designs around.

Why scammers get past it

I can't see inside Apple's or Google's models, so treat this as my read of how these systems have to work, not a leak. A filter is looking for signals: a sender it's seen blasting thousands of messages, a link that matches a known bad pattern, wording it's seen in a million spam runs. Take those signals away and there's almost nothing left to judge.

Here's how scammers take them away.

They start boring. The "wrong number" opener, the "are we still on for Thursday?" text, the "hey, it's been a while!" message. No link, no ask, no pressure. It reads like a human wrote it, because a human (or a script pretending to be one) did. I wrote about how that opener turns into a months-long con in the wrong number text scam post. The first message isn't the scam. It's the door.

They change the sender. A filter that learns from a number's behavior is chasing something that's cheap to replace. If one number gets burned, the next one is a few clicks away. I dug into one extreme version in the SMS blaster post, where texts are pushed to phones through fake cell equipment, so the usual checks between the sender and your lock screen never get a say.

They get you to reply. This one makes me grind my teeth. Apple's guide notes that Text Message Filter "doesn't apply to any sender you've replied to three times or more." That's a reasonable rule for the filter, since a number you chat with isn't a stranger. It's also a polite way of saying that a scammer who gets you into a conversation has stopped being a stranger to the software.

They send the link later. First message: friendly. Message six: "Here's the platform I use." By then you've built a relationship, and the filter has been looking at nothing for days.

Blue, green, RCS: none of that is a trust signal

People ask me whether a green bubble is more suspicious than a blue one, or whether an RCS chat is safer than an old-school text. I've seen no reliable evidence for any of it, and I'd skip the theory.

The color tells you how a message traveled. It tells you nothing about who typed it. Apple's own guide lists SMS, MMS and RCS together as things its Text Message Filter looks at, which tells you the company doesn't treat any one of them as the safe lane.

And "it came through as a normal text" gets the logic backwards. A message landing in your main inbox means one of two things: the filter didn't flag it, or the filter isn't turned on. Neither one is a verdict on the sender.

The red flags no filter can see

A filter reads patterns. You can read context, which is the thing scammers can't fake well. These are the signals worth catching yourself:

• You didn't start this. You never texted this number, filed this claim, or ordered this package. The message is unprompted and acts like it isn't.
• A stranger who knows your first name. Your name isn't secret. It proves nothing.
• An ask to move channels. "Let's switch to WhatsApp" or "text me at this other number" is a scammer getting off a platform that can see them.
• A deadline. Real accounts don't lock in 24 hours because you didn't tap a link.
• Money, codes, or credentials. Any message that wants a payment, a verification code, or a login should make you stop.
• A story that escalates. Small talk to friendship to a "can't-miss" opportunity. The ramp is the tell.
• A number you can verify. If it says it's your bank, look up the bank's number yourself. The FTC's advice is to contact the company using a phone number or website you know is real, not the one in the text.

If one already got through

Calm down first. A scam text in your inbox hurts nobody. A reply or a tap is where things can start, and even then, there's a lot you can do.

1. Don't tap, don't reply. Not even "STOP" to a stranger, since any reply can tell them the number is live.
2. Forward it to 7726 (SPAM). The FTC says this "helps your wireless provider spot and block similar messages in the future."
3. Report it at ReportFraud.ftc.gov. One report looks small. A pile of them is how patterns get spotted.
4. Use the report button in your app. In Google Messages, reporting a conversation moves it to Spam & blocked and, per Google, sends the spammer's number and the last 10 incoming messages to help improve detection. That's a trade you should know about before you tap it.
5. If you replied with details or clicked, change passwords from a different device, turn on an authenticator app for your important accounts, and read the what to do after clicking a scam link checklist.

None of this is on you. These messages were engineered by people who test what gets past the filter, and then ship it at scale.

How to stack the odds

Think of the filter as a first pass, not a bodyguard.

• Turn it on. On iPhone, check Manage Filtering in Messages and decide whether Screen Unknown Senders fits your life. If you wait on verification codes from new numbers, allow that category so you're not stuck.
• Look in the folder sometimes. A filter you never check is just a place where real messages go to die.
• Check the whole message, not just the link. A clean-looking link inside a bad story is still a bad story. The 30-second check for a suspicious text walks through it.
• Know the bigger picture. Text is a favorite scammer channel for reasons I laid out in scam texts getting worse. If you've ever wondered why it feels like more of them get through lately, that post has the context.
• Keep your Android basics tight. If you're on Android, call and text protections differ by phone, so it's worth knowing what yours actually has on.

When you want a second opinion on something that feels off, paste the full message into the scam text checker. Your first scan is a free trial (one scan every 30 days, no card), and Cautellus Plus is $9.99/month if you want to keep checking. Either way, the check beats guessing.

For more on this whole genre, the text message scams hub collects the patterns in one place.

Sources: Apple, Screen and filter text messages on iPhone; Google, Google Messages spam detection and Report spam; FTC, How to recognize and report spam text messages.

Your phone can sort the junk. It can't tell when someone is lying to you, and the scammers write like they know it.