In this article
You do not have to decide whether a message is definitely fake before declining to use it. “Unverified” is a useful working conclusion. It leaves room to check a real bill through a channel you choose.
Record the claim, not the secrets
Privately identify what the message wants: a payment, a login, a code, a card update, a download or a callback. Then identify the consequence it threatens or promises. “Your service stops now unless you pay here” combines urgency with a destination supplied by the sender. Neither element establishes the account’s actual status.
Keep this exercise local. Do not paste a whole message into this publication. Links can contain account-specific tokens; screenshots can reveal names, numbers and notifications. Our homepage tool only asks which broad situation applies.
Use a three-column mental worksheet
- Claim: what the sender says is happening.
- Evidence: what you saw after independently opening the account or contacting the carrier.
- Decision: what you will do through that separate channel.
Leave evidence blank until you have it. A correct name, a recognizable sender label, good grammar or a recently paid bill is context, not proof of who controls the message. This is a decision aid, not a scoring formula that can certify a sender.
Two fictional messages, the same safe process
Message A claims an overdue bill and supplies a short link. Message B says a recent payment failed and asks for a verification code. The wording differs, but the next step is the same: do not use the supplied route to resolve the claim. Open the official service independently. For B, do not send a code to the requester while investigating.
If the account independently shows a payment task, complete that task on the carrier service. That does not retroactively validate the original message. If no matching task appears, preserve only what you need for a report and use official help if uncertainty remains.
Reporting is not replying
Metro’s guidance says to forward spam or unwanted texts to 7726 rather than replying, including with “STOP.” That reporting route is separate from responding to the sender. Follow the current carrier instructions. A report does not automatically recover money or resolve an account problem.
The FTC also provides a phishing reporting route. If you already acted, move to the exposure checklist rather than spending more time judging the message’s appearance. If you have not acted, start a separate payment session.
Evidence and limits
Public sources checked November 4, 2026. The practical sequence and fictional examples are our editorial analysis. This is not a security scan, a fraud determination or an account investigation.
- Metro: Scam Shield FAQ: Report spam texts to 7726 rather than replying. Network filtering is not a guarantee that every delivered message is legitimate.
- FTC: Recognize and avoid phishing: Reach the company through a known independent channel, report phishing, and seek recovery guidance for exposed information.