SMS sender ID spoofing: what it is and how to spot a fake text

You get a text from "Royal Mail", "USPS" or your bank's name, sitting right under messages you know are genuine, asking you to pay a small fee or confirm your details. It looks real because the sender label was faked. This guide explains how sender ID spoofing works, why it's harder in some countries than others, and the simple checks that protect you.

What is a sender ID?

The sender ID is what your phone shows as the author of a text. It can be a regular phone number, a short code (a 5 or 6-digit number businesses use) or, in many countries, an alphanumeric name like "Amazon" or "HMRC". Businesses send most of these messages through SMS platforms that let them set that label.

Because the label is set by the sender's system rather than checked against who they really are, it can be abused. That abuse is sender ID spoofing.

How does SMS sender ID spoofing work?

A scammer sends texts through a route that lets them choose the sender name or number, and picks one that belongs to a brand you trust. Your phone groups messages by sender, so a spoofed "Bank" text can appear in the same conversation as real messages from your bank. That's what makes it convincing.

In the US and Canada, alphanumeric sender names aren't generally supported, so scam texts more often come from ordinary mobile numbers, lookalike numbers or short codes. The trick there is less about faking the name and more about writing a message that sounds official.

How countries are fighting it

These measures cut down on spoofing but don't stop all of it, and scammers keep switching routes. Your own checks still matter.

Signs a text uses a spoofed sender

• It's unexpected and urgent: a missed delivery, a blocked account, a refund or a fine.
• It asks you to tap a link, call a number or pay a small fee.
• The link doesn't go to the company's real domain, or uses a URL shortener.
• It asks for a verification code, a PIN or a password. No real company asks you to send a code back by text.
• The wording, spelling or formatting is slightly off compared with genuine messages from that company.

What to do if you get one

Don't reply, don't tap the link and don't call the number in the message. Open the company's official app or type its website address yourself to check whether anything is really wrong.

Report it: in the US, UK and Canada you can forward a scam text to 7726 (SPAM) so your carrier can block the route. Then delete it. If you already entered details or a code, change your password right away, turn on an authenticator app, and contact the company or your bank through official channels.

Can a virtual number be used to spoof a sender ID?

Not on Noir SMS. Our numbers receive SMS only. They can't send texts or make calls, so they can't be used to send messages under anyone's name. They exist so you can verify your own accounts without exposing your personal number, which also means fewer places that can leak it to scammers.