Texts and calls

The Unemployment Claim Confirmation Text Scam, October 2026

Updated 23 October 2026

You are not unemployed, but the text says you just filed a claim, and a link wants you to confirm it. The confirmation page is the trap, and the only thing actually moving is your identity out the door.

The confirmation text, the trap, and what the link really takes

The text arrives with a state agency name you half recognise, a case number, a dollar figure, and a short link that ends in a domain you have never typed. The message reads like a confirmation of something you have already done, which is the entire trick. You did not file a claim. The scammer did, using a name, a date of birth, and a Social Security number bought on a forum somewhere, and the next click is what turns a wrong address into a working account in their hands.

Open the link on a laptop if you must look, never on the phone the text came in on, and watch what the page asks for. Real state unemployment portals ask you to sign in to an account you already have. Scam pages ask you to create one, with a fresh email, a new password, and a phone number that you conveniently enter yourself. That phone number plus the new password is the prize, because the same phone is what your bank, your email, and your carrier use for one time codes. Once the scammer has the inbox and the phone, every password reset in your life routes through them.

The second purpose of the link is document upload. The page asks for a photograph of your driving licence, a recent pay stub, or a W 2. State agencies already have those. Scam pages ask because they need a clean image of the front of your licence to sell or to use on a synthetic account. If you upload a real document, the damage is no longer a wrong text. It is a working identity kit. Pull your driving licence number through your state DMV portal and the IRS Identity Protection PIN from irs.gov the same hour, before anyone else can.

You will also see a phone number in the text. Call it. A real state labor office answers with a hold queue, a caseworker, and a callback reference. The scam line answers on the second ring, names a fake case number, and walks you through the same verification you were going to do on the website. Every minute you stay on that call is a minute the scammer learns the answers to your real verification questions, the ones your bank will ask tomorrow morning.

Why this wave landed in October 2026, and which states are hit hardest

State unemployment systems were built in 2020 and patched through 2024, which is the kind of history that leaves a lot of front doors that look the same to the public. When a wave of confirmation texts goes out, the scammers are not testing each state one at a time. They are scraping the public facing claim lookup pages, copying the wording, and sending a single template to ten million numbers with the agency name swapped at the gateway. The state name in the text is whichever name your area code most often matches, which is why the message looks plausible to your thumb before your brain has read it.

Public reporting in October 2026 points to confirmation texts impersonating agencies in California, New York, Texas, Florida, Pennsylvania, Ohio, Georgia, and Illinois, with smaller clusters in Washington, Colorado, and Massachusetts. The Federal Trade Commission logged a measurable jump in identity theft reports tagged "government benefits" through the first three weeks of October, and several state labor agencies posted short alerts on their own home pages telling residents to ignore confirmation messages they did not request. None of those alerts ask you to reply to the text. None of them ask you to click. They tell you to log in to the account you already have, or to call the number printed on the state website you found yourself, not the number inside the text.

Two shifts make October 2026 the right month for this scam. First, the IRS has been reissuing Identity Protection PINs for the 2026 filing season, so a steady stream of taxpayers are expecting mail from a government agency that includes a short code. Scammers borrow the format. Second, autumn is the season of contract work ending, holiday hiring starting, and a great deal of people quietly claiming between jobs. A confirmation text about a claim you might have filed in a tired moment at the kitchen table looks like something you forgot, which is the exact mood the scammer wants.

The law on the table, and what each agency will actually do

Unemployment insurance is administered by the states under federal rules set by the Department of Labor, and the actual money sits in a state trust fund. Identity theft in this space is prosecuted under state identity theft statutes, which in most states carry felony weight, and under federal statutes that include 18 U.S.C. § 1028 (fraud and related activity in connection with identification documents) and 18 U.S.C. § 1343 (wire fraud). The agency that writes the cheque is not the agency that investigates the crime, and you need to know the difference.

Report the scam to the FTC at reportfraud.ftc.gov and to the Internet Crime Complaint Center at ic3.gov, both on the same day. The FTC entry feeds the Consumer Sentinel database that state and federal law enforcement search when they start a case. The IC3 entry feeds the FBI. A report at either place creates a dated record, which is the document you will need when you dispute new accounts, when you ask the credit bureaus to block fraudulent tradelines, and when you ask a state labor agency to mark a fake claim as not yours.

Then file an identity theft report with your state labor agency through the same portal you would use to file a real claim. Most states now have a clear "this claim is not mine" link on the front page of their unemployment site, and the form takes about ten minutes. The agency will mark the claim as fraudulent, deactivate the employer account the scammer stood up in your name, and issue you a written confirmation. Keep that confirmation. It is the document a bank, a landlord, or a future employer will ask for if a fake claim resurfaces.

Place a free fraud alert with any one of the three credit bureaus (Equifax, Experian, or TransUnion), which by law must notify the other two, and request a free credit report at annualcreditreport.com to look for accounts you did not open. If you uploaded a document through the scam link, ask the FTC and your state attorney general for a written identity theft report, which lets you file an extended fraud alert and a credit freeze that lasts seven years. A freeze is free, it does not affect your credit score, and it stops a new lender from issuing credit in your name without a password you control.

The ten minute recovery, in the order that actually works

Step one: do not click. Do not reply. Do not call the number in the text. Screenshot the message, including the sender, the time stamp, and the full link, and forward the text to 7726 (SPAM), which sends it to the GSMA spam reporting service used by US carriers. That report is what your carrier uses to block the short code across the network, and the same report is what the FCC pulls from when it goes after the worst offenders.

Step two: log in to the unemployment account you already have, or to the state portal through a bookmark or a search result you trust, and look for any claim tagged with your name and Social Security number. If you see one you did not file, use the "this is not my claim" link and follow the state process to mark it fraudulent. Do not delete the claim record. The agency needs the case open so the investigation can run.

Step three: place a fraud alert with one credit bureau, request a credit report, and rotate the password on the email account that owns your phone number. The email is the master key, not the phone. If the scammer now has a password reset link for your email, every other account falls within the hour. Use a unique password, store it in a real password manager, and turn on a hardware key or an authenticator app for the email account. SMS as a second factor is no longer safe, and your email is the only account where the rules still bend toward the attacker.

Step four: file at reportfraud.ftc.gov and at ic3.gov on the same sitting, then visit identitytheft.gov to download the FTC identity theft report and the recovery plan tailored to your state. The plan is a checklist of letters to send to the credit bureaus, to debt collectors, and to businesses where a fraudulent account was opened in your name. Send the letters by certified mail, keep the receipts, and keep a single folder of every reply.

Step five: if you uploaded a document through the scam link, request a new driving licence number through your state DMV, and ask the IRS for a fresh Identity Protection PIN through irs.gov. A new licence number kills any synthetic account built on the image you uploaded, and a new IRS PIN kills any tax return filed in your name for 2026. Both are free, both can be done in a week, and both are the only durable way to put the genie back in the bottle.

The pattern behind the text, and the next three that are coming

The unemployment confirmation text is one slot in a wider pattern of fake confirmations aimed at government benefits. The same template, with the agency name swapped, will be aimed at SNAP benefits, at Medicaid renewals, at child tax credit updates, and at the new federal paid leave program. The rule of thumb is the same. A real agency never confirms a benefit you did not apply for. A real agency never sends a link to a domain you have not used before. A real agency never asks for a driving licence photo, a W 2, or a Social Security number by text.

The next three waves to expect through the end of 2026 are the Medicare open enrolment confirmation, the stimulus refund confirmation, and the jury duty fine confirmation that routes to a bond payment. All three are built on the same idea, which is that you half remember signing up, you half expect a letter, and you are tired enough to click. The cure is the same. You log in to the account you already have, or you call the number on the website you found yourself, or you ignore the message entirely and call the agency in the morning.

Identity theft of this kind is not a single event. It is a process that plays out over six to eighteen months as the scammer opens accounts, files claims, and uses the documents you uploaded. The work you do in the first week is the work that limits the damage, and the work you do in the first day is the work that determines how much of the damage is reversible. Treat the confirmation text as the start of the case, not the end of the message.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.