MalwareZero

Wrong number text scam: the friendly opener to a long con

Updated August 6, 2026

77 percent. That's the share of people the FBI phoned mid-scam who had no idea they were being defrauded, out of 8,935 warned as of March 2026. Plenty of those cases opened with a text from a number nobody recognized. "Hey, is this Anna?" You reply that they've got the wrong number, they apologize warmly, and somehow the conversation keeps going. The CFTC calls the pattern a relationship investment scam. The request for money is usually weeks or months away.

Unknown NumberText message
SCAM, NOT REALHey, is this Anna?
Recreated example of the wording used in this scam. Not a real captured message; built to match the pattern described on this page.

The agency names this pattern outright. Its investor alert on relationship investment scams says the crews work through dating apps, social media, professional networking sites, messaging apps, and random "wrong number" text messages. Same crime, different front door. The industry nickname for it is pig butchering, which tells you how the people running it think about the timeline.

What the first message actually looks like

There's no link in it. No attachment, no login page, nothing to tap. That's deliberate, and it's a big part of why carrier spam filters let so many of these through.

The wording changes constantly, but the shapes repeat. A name that isn't yours ("Hi David, don't you remember me?"). A plan you never made ("are we still on for lunch Thursday?"). A role you don't have ("is this the tennis coach?"). Sometimes it's just "Hello" at nine in the morning, sent to ten thousand numbers at once.

Most people treat that first text as the scam. It isn't. It's a screening call, and the only thing it screens for is whether you're the kind of person who replies to strangers.

The slow build, which is the actual product

If you answer, you get a pen pal. Good morning texts. Photos of a dog, a gym, a plate of food. A job that sounds vague and prosperous: jewelry import, logistics, "my uncle runs a fund." It can go on for a month before anything financial is mentioned at all.

Voice notes come next, then video calls in some cases, which is why "we talked face to face so they must be real" has stopped being proof of anything. Generated faces and cloned voices are cheap now. If you want the short version of how that works, our page on AI voice cloning scams covers it, and the family safe word generator is a five minute fix worth doing regardless of this particular scam.

The CFTC lists four tells that hold up well. They can never meet in person. They push the conversation onto an encrypted messaging app. They claim expertise in crypto trading. And they offer to help you do it too.

The pitch, and the trick inside it

It's never "send me money." It's "let me show you what I do." You end up on an app or website that looks like a real exchange, with charts, order books, a support chat, the works.

You put in a small amount. It goes up. You withdraw it, and the withdrawal works. That successful first withdrawal is the entire mechanism, because after it, the number in the account stops being a number and starts being your money. The CFTC describes the later stages plainly: fake screenshots, a manipulated account balance, and then, when you try to take the real amount out, an excuse. More funds are needed. A fee. A tax you were never told about.

Nobody ever gets past that step. The account was a web page.

Why it's a factory and not a person

The reason you get these texts at all is that the sending is industrialized. Much of it runs out of walled compounds in Southeast Asia, and the best documented is KK Park near Myawaddy on the Myanmar side of the Thai border, raided in late 2025. More than 1,500 people from 28 countries crossed into Mae Sot in Thailand in the aftermath. Press reporting puts the number of similar compounds along that stretch of border at roughly 30.

Many of the people sending the messages were trafficked into the job and describe shifts of well over twelve hours. That matters for two practical reasons. The warmth is scripted, written by someone else, delivered under duress. And the volume explains why a total stranger has your number: it wasn't chosen, it was dialed.

Enforcement has picked up. Multi-country operations in 2026 produced hundreds of arrests and large asset seizures, though I couldn't tie every widely quoted figure back to a primary agency document, so treat the round numbers loosely. What I can point at is the FBI's own Operation Level Up, which proactively calls people it believes are mid-scam. As of March 2026 the Bureau put that at 8,935 people notified, an estimated $562 million saved, and, the number that should stop you: 77 percent of them had no idea they were being defrauded.

How to warn a family member without losing them

That 77 percent figure is the whole problem. Someone six months into this doesn't experience it as a scam. They experience it as the closest relationship they've had in years, plus a portfolio. Leading with "you're being scammed" makes you an obstacle to both.

Go after the platform instead of the person. Ask them to withdraw a real amount, not a test amount, to a bank account they control, today. That request costs nothing, doesn't insult anyone, and it produces the evidence on its own timeline. The fee demand or the sudden tax bill lands far harder coming from the scammer than from you.

A few other things that help more than arguing:

I can't tell you how long it takes. Sometimes the withdrawal test ends it in an afternoon. Sometimes nothing lands until the money is gone and the account goes quiet on its own. Both happen.

What to do with the text you got today

Don't reply. Not even "wrong number," and not "stop." Any reply confirms a live human on a live number, which is worth money to whoever is buying lists.

Forward the message to 7726, which spells SPAM on the keypad. AT&T, T-Mobile and Verizon all support it. Your carrier will usually text back, and some send a follow-up asking for the sender's number, so answer that second message to finish the report. Then block and delete.

If you want it counted in the national numbers, report it at reportfraud.ftc.gov. Takes about three minutes.

If money has already moved

File at ic3.gov, and type that address in rather than searching for it. Include wallet addresses, transaction hashes, the platform's URL, the phone number and any usernames, plus screenshots of the chats. For trading fraud you can also file at cftc.gov/complaint, and sec.gov/tcr if securities were involved. Your state attorney general is worth a report too.

Then brace for the second wave. Within days of a public complaint, people start appearing who claim they can get the funds back for a fee. That's a separate industry with its own playbook, and it's worth reading about fake crypto recovery services before anyone offers you one.

My own view, for what it's worth: people overrate that first text and underrate the reply. The message itself has no link and no payload. It can't do anything. The reply is the entire decision, and I think most of the advice out there spends too long on how to recognize a fake stranger and not nearly enough on the simpler habit of leaving unknown numbers unanswered.