Text Scams Explained: How Brand Impersonation Works
A text arrives from a company you recognise. It mentions a missed payment, an account problem or an urgent security check. The name at the top of the message looks familiar, the wording sounds plausible and the link appears to lead to the company’s website.
Yet the company did not send it.
This is SMS brand impersonation, often called smishing when the message is designed to steal information or money. Criminals borrow the identity of a trusted organisation to lower the recipient’s guard. They may copy its name, tone, website design and customer journey closely enough that a hurried reader sees nothing unusual.
For businesses, the consequences extend beyond the people who click. Customers often associate the scam with the organisation being impersonated, even where its systems were never compromised. That creates support costs, reputational damage and doubt around genuine messages.
Understanding how text scams work is the first step towards reducing that risk.
What is a brand impersonation text scam?
A brand impersonation text scam is a fraudulent message that presents itself as communication from a legitimate organisation.
The criminal does not need to breach that organisation’s messaging platform. In many cases, they simply reproduce visible parts of its identity, including:
The brand name
A familiar SMS Sender ID
The language used in genuine customer messages
A logo or website design
A common customer request, such as making a payment
A web address that resembles the real domain
A believable service event, such as a delivery, booking or account alert
The message normally asks the recipient to take an action. That might involve opening a link, entering card details, confirming a password, downloading an application or calling a fraudulent support number.
The National Cyber Security Centre defines phishing as the use of scam emails, texts or calls to trick people, commonly by directing them to a website that steals bank details or other personal information. When this happens through SMS, it is usually described as smishing.
The effectiveness of the attack comes from misplaced trust. The recipient recognises the organisation before assessing the request.
How SMS brand impersonation works
Most impersonation campaigns follow a simple sequence.
1. The criminal selects a trusted brand
Scammers favour organisations that have large customer bases or naturally send time sensitive messages. Banks, parcel companies, parking services, government departments, retailers and subscription platforms are frequent targets.
The criminal does not necessarily know whether the recipient uses the brand. A campaign can still be profitable when messages are sent widely because only a small proportion of recipients need to respond.
In more targeted attacks, the fraudster may use information from data leaks, social media, public records or earlier phishing activity to make the message more relevant.
2. The message creates a believable problem
The text presents an event that appears routine but requires attention. Common examples include:
An unpaid parking charge
A failed parcel delivery
A suspicious bank transaction
An overdue subscription
An account verification request
A tax refund or government payment
A temporary suspension of service
The request is usually small enough to feel plausible. A demand for £2.99 to rearrange a parcel or a modest parking payment may attract less scrutiny than an immediate request for hundreds of pounds.
The first payment may not be the fraudster’s final objective. The fake page can capture card numbers, security codes, login credentials, addresses and telephone numbers for later misuse.
3. Urgency discourages verification
Most text scams give the recipient a reason not to pause.
The message may warn of a larger fine, account closure, service interruption, court action or damage to a credit record. Deadlines are often unusually short.
This is deliberate. A recipient who feels under pressure is more likely to use the supplied link rather than open the official app, type the known website address or contact the organisation independently.
Poor spelling used to be a common warning sign. It is less reliable now. Scam messages can be grammatically correct, carefully branded and adapted to local terminology.
4. The recipient is directed away from a trusted channel
The link normally leads to a website controlled by the criminal.
A fraudulent domain may:
Replace one letter in the genuine brand name
Add words such as “secure”, “payment” or “support”
Use a different domain extension
Place the brand name within a longer, unrelated address
Use a shortened URL that conceals the destination
Redirect several times before reaching the payment page
The fake site often copies the genuine website closely. Logos, colours, fonts and form layouts can be reproduced from publicly available material.
A padlock icon does not prove that the site belongs to the brand. It only indicates that the connection between the browser and that particular website is encrypted.
5. Stolen information is used or resold
Once information has been entered, the criminal may attempt card payments, access an account or pass the data to another fraud group.
A convincing phishing page may also ask for a one time passcode. This can allow the attacker to authorise a live transaction while the victim believes they are confirming a small payment.
The scam can then move to another channel. A victim might receive a follow up call from someone claiming to be the bank’s fraud team, using details collected from the original form to sound credible.
Text scams are therefore rarely an SMS only problem. The message is often the first step in a wider, cross channel fraud journey.
The current RingGo text scam (as of 2026)
RingGo warned customers in June 2026 about fake texts claiming that recipients had an “outstanding parking payment” or an “unpaid parking session”. Its guidance tells users not to click links in these messages and to check parking activity through the official RingGo app or website instead. RingGo has also stated that it is aware of phishing emails and text messages that appear to come from the company but are sent by scammers.
The campaign is a clear example of how criminals use ordinary customer behaviour against a brand. Parking payments are often made quickly, while the amount requested may be low enough to appear credible. A recipient who recently parked somewhere may assume the message relates to a genuine session. The scammer supplies the brand name, an urgent payment problem and a direct route to a fraudulent page. RingGo advises customers to avoid the link and verify their account independently, while its website currently warns of an increase in SMS scams alleging unpaid parking fees.
Can scammers make a message appear to come from a real brand?
SMS messages can use an alphanumeric Sender ID, which is the name displayed in place of a telephone number. A genuine business might use its brand name so customers can recognise the sender.
Criminal misuse of Sender IDs has historically made impersonation more convincing. Depending on the route, network controls and handset behaviour, a fraudulent message may display a familiar looking name. In some circumstances, messages with matching identifiers can appear alongside genuine communications, making visual recognition alone an unreliable test.
A Sender ID is therefore an identification label, not proof that the message has been authenticated by the recipient’s phone.
The UK messaging industry uses measures including Sender ID protection, business verification, traffic monitoring and filtering to reduce misuse. The NCSC also recommends that organisations use a Sender ID that reflects their brand rather than a generic label such as “Alert” or “NoReply”.
These controls matter, but no single mechanism removes every form of impersonation. A fraudster may use:
A close variation of the brand name
A normal mobile number
RCS or another messaging service
A fake domain without copying the protected Sender ID
A fabricated company name
A compromised legitimate account
Traffic routed through providers with weaker checks
Ofcom’s July 2026 statement on mobile messaging scams notes that criminals also use fabricated or obscure business names rather than always impersonating a recognised brand directly. In Ofcom’s analysis of a sample of 4,000 messages reported to 7726, 137 were scams using an alphanumeric Sender ID. Around 30% of those appeared to impersonate a real brand, while many others used invented or obscure business identities.
This is why anti fraud controls need to assess more than an exact name match.
Why brand impersonation damages legitimate businesses
The immediate financial loss belongs to the victim, but the brand also absorbs part of the impact.
Customers lose confidence in genuine messages
Once customers have seen a convincing scam, they may distrust real payment reminders, security alerts and service notifications.
That can reduce response rates and create friction in legitimate customer journeys. A message intended to prevent fraud may itself be mistaken for fraud.
Customer service demand increases
Recipients commonly contact the impersonated organisation to ask whether a message is genuine. Others report fraudulent payments, suspicious websites or misuse of their personal information.
Support teams then need a clear process for identifying the campaign, reassuring customers and directing victims to the appropriate reporting channels.
Fraudsters benefit from the brand’s investment
Trust takes years to build. An impersonator can borrow it in seconds.
The criminal uses the organisation’s reputation, design and established messaging habits without needing to recreate the underlying service. The stronger and more familiar the brand, the more persuasive the false communication may become.
Incident response becomes fragmented
Evidence of a campaign may arrive through customer complaints, social media, network reports, fraud teams, domain monitoring or a CPaaS provider.
Without a defined process, different teams may investigate the same attack separately. That delays the sharing of Sender IDs, telephone numbers, message samples and malicious URLs with organisations that can act on them.
Warning signs of an impersonation text
No single clue proves that a message is fraudulent. Several small inconsistencies often appear together.
Recipients should be cautious when a text:
Arrives unexpectedly
Creates an unusually short deadline
Threatens a fine, suspension or legal action
Requests card details, passwords or security codes
Links directly to a login or payment page
Uses a web address that differs from the known company domain
Asks the recipient to install software
Requests a reply to an unknown sender
Contains vague account information
Refers to a service the recipient does not use
Context matters. A parking payment message may look convincing after a recent journey. A delivery scam may appear plausible while the recipient is waiting for several parcels.
The safest approach is to leave the message and verify the request separately. Open the official application, type the known web address into the browser or call a telephone number obtained from a trusted source.
Ofcom advises people not to click links in unexpected texts, even where the sender appears familiar. For requests involving payment or account access, users should go directly to the organisation’s website rather than follow the supplied link.
What businesses can do to reduce SMS impersonation
Businesses cannot stop criminals from copying every public part of their identity. They can make impersonation harder, improve detection and reduce the damage when a campaign appears.
Protect and govern Sender IDs
Organisations should maintain a clear record of the Sender IDs they use, the providers authorised to send them and the countries in which those identifiers are active.
Sender ID protection and verification can help operators distinguish authorised messaging from fraudulent traffic. Brand Assure was founded by telecom and CPaaS specialists to address the operational work involved in brand validation, and its service combines automated checks with human oversight.
Governance also matters internally. Marketing, operations, fraud and customer service teams should not create new message identities independently without a shared approval process.
Standardise genuine customer communications
Customers are better able to identify anomalies when legitimate messages follow predictable rules.
A business might decide that it will:
Never request a full password by SMS
Never ask for a one time passcode
Direct customers to its app rather than a payment link
Use a small, controlled set of approved domains
Use consistent Sender IDs
Avoid URL shorteners
Explain its genuine payment and support process publicly
These promises must be realistic. Publishing a rule and then breaking it during a marketing campaign weakens its value.
Monitor domains, URLs and message patterns
Impersonation rarely relies on the brand name alone. Malicious domains, payment pages, telephone numbers and recurring message templates can provide useful detection signals.
Monitoring should look for:
Lookalike domain registrations
Newly observed Sender IDs
Sudden changes in traffic volume
Repeated scam URLs
Messages using unapproved calls to action
Customer complaints sharing similar wording
Campaigns appearing across more than one network
The objective is not simply to create alerts. Evidence needs to reach the provider, network, registrar, hosting company or enforcement body capable of acting on it.
Give customers a visible reporting route
Customers should not need to search through several pages to report a suspicious message.
A dedicated reporting address or form can help the business collect:
A screenshot of the text
The displayed sender
The date and time
The full URL
The requested action
Whether information or money was provided
Businesses should avoid asking customers to open a suspicious link to gather more evidence.
Prepare an incident response plan
A practical response plan should define who assesses the message, who contacts messaging providers, who requests domain takedowns and who publishes customer guidance.
Prepared wording can save time, but it should be adapted to the incident. The response needs to explain exactly what the scam claims, how genuine communications work and what affected customers should do next.
Speed matters because campaigns can change domains and message wording quickly.
What to do after receiving a scam text
Recipients should not click the link or reply to the sender.
Suspicious SMS messages can be forwarded free of charge to 7726. This reports the message to the mobile provider, which can investigate its origin and take steps to block the sender. Ofcom recommends reporting the message, using the phone’s built in spam controls and then deleting it.
Anyone who has entered payment details should contact their bank immediately using a trusted telephone number. In England and Wales, losses or compromised information can also be reported to Report Fraud. People in Scotland should contact Police Scotland where appropriate.
The organisation being impersonated should also be told. A clear screenshot and the destination URL may help its fraud or security team identify the campaign.
Frequently asked questions
-
A text scam is a fraudulent SMS or mobile message designed to persuade someone to disclose information, make a payment, install software or contact a criminal. The message may impersonate a company, public body or individual. Text based phishing is commonly called smishing.
-
Yes. A scammer can type a company name into the message, imitate its tone or use a similar looking Sender ID. The presence of a recognisable brand name does not prove that the organisation sent the communication.
-
Messaging applications may group communications according to the identifier presented with the message. Where a fraudulent message displays an identifier that matches or resembles a genuine one, the handset interface may make the message appear more credible. Customers should verify sensitive requests through an independent channel rather than rely on the conversation view.
-
Not necessarily. Many impersonation campaigns use publicly visible brand information and send messages to large lists of telephone numbers. A relevant or well designed message is not, by itself, evidence that the company’s systems or customer database have been compromised.
-
Do not use the message link. Open the organisation’s official app, type its known website address into your browser or contact it through a trusted number. Check the account directly for an outstanding payment or alert.
Key takeaways
Text scams work because they place a false request inside a familiar identity.
The brand name, Sender ID and copied website reduce suspicion. Urgency then pushes the recipient towards a link before they independently verify the request.
For businesses, SMS brand protection requires several layers:
Controlled and verified Sender IDs
Clear rules for genuine customer messages
Monitoring of URLs, domains and traffic patterns
Fast intelligence sharing
Simple customer reporting
A prepared incident response process
The current RingGo text scam shows how easily a familiar service interaction can be turned into a phishing scenario. The company does not need to have suffered a system breach for criminals to copy its identity and target its customers.
Brands should assume that public trust can be imitated. The task is to make fraudulent use easier to detect, harder to deliver and faster to disrupt.
To discuss Sender ID validation, brand onboarding and messaging trust controls, contact the Brand Assure team.
