SMS, call and messenger scams
Recognise the court-notice, parcel, fake-bank-call, fake-deposit and friend-in-trouble scams, and use one move that defeats all of them: check through a channel you choose yourself.
THE SENDER CAN LIE
Who it seems to be from proves little
The name or number a message or call shows can be faked, and a friend's account can be hijacked (lesson 1). So "it came from the bank's name" or "it's my cousin's account" is not proof. A serious-sounding notice sent from an ordinary personal mobile number is an easy giveaway, but an official-looking sender doesn't prove a message is real either.
An SMS about a court complaint arrives from a normal 0912 number. A real court isn't messaging you from someone's personal phone.
Common SMS scams in Iran
- Court or judicial notice: "A complaint has been filed against you, view it here." The link leads to a fake app or payment page.
- Parcel or customs fee: "Your package is held, pay a small fee." The small fee is bait for your full card details.
- Subsidy, registration or fine: "Register for your payment" or "view your traffic fine" with a link.
- Prize: "You've won a car or cash, pay the fee to claim it."
- Real notices and fines can always be checked by going to the official service yourself, never through the link in the text.
Check yourself
Arman gets an SMS: "Your electronic judicial notice has been issued. To view it, tap the link." He's worried because he did have a dispute with a landlord last year. What should he do?
- Tap the link just to look, since only viewing a page without typing anything can't hurt
- Reply to the SMS asking which case it's about
- Skip the link and check the official judiciary service himself
- Forward it to family members to ask whether it looks real
Show the answer
Skip the link and check the official judiciary service himself
Right. If a real notice exists, he'll find it through the official service. The link adds nothing except the risk of a fake app or payment page.
THE CALL
"Hello, this is your bank"
Phone scams follow the phishing recipe out loud: a trusted name, a scare ("suspicious transaction", "your card will be blocked"), and a quick action. The action is usually to read out your card number, CVV2, expiry date, dynamic password or an SMS code, or to go to an ATM and follow instructions. Banks don't ask for your PIN, CVV2 or one-time passwords over the phone. Anyone who does is not your bank.
The caller already knows your name and the last four digits of your card. That's easy to get and proves nothing. The moment they ask for a code or password, the call is over.
Hang up and call back
- 1 · End the call politely
"I'll call the bank myself." A real employee won't mind. A scammer will push, which tells you everything.
- 2 · Find the number yourself
Use the number on the back of your card or in the bank's official app, not one the caller gave you.
- 3 · Ask directly
"Is there a problem with my account?" If there is, they can see it and help.
- 4 · Report it
Tell your bank about the fake call. In Iran you can also report online fraud to the cyber police (FATA).
Check yourself
Zohreh's phone shows her bank's official support number on an incoming call. That's proof the caller really works at the bank.
Show the answer
False
False. Caller ID can be faked, so a familiar number on screen proves nothing on its own. The safe move doesn't depend on the number at all: hang up and call the bank back on the number from her card or app.
THE FAKE DEPOSIT
"I sent money to your card by mistake"
You get an SMS that looks like a bank deposit alert: a large amount has arrived in your account. Soon someone calls or messages: they sent it by mistake, please send it back. But the alert was a fake SMS and no money ever arrived. If you "return" it, you're sending your own money. The check is simple: look at your real balance in your bank's app, not at the SMS.
Even if money really did arrive by mistake, the safe answer is: "Ask your bank to reverse it." A real mistaken transfer can be sorted out between the banks.
THE FRIEND
A friend who suddenly needs money
A hijacked messenger account messages everyone in its contacts: "I'm stuck, can you send me some money by card-to-card? I'll pay you back tonight." It feels real because it's their name, their photo, even your old chat above it. Before sending anything, call your friend by voice on the number you already have, or ask something only they would know.
Nima gets that message from Kaveh's account. He calls Kaveh, who is at home and has no idea. His account was taken an hour ago.
Check yourself
Match each scam to the check that beats it
Show the answer
- SMS: "View your court notice here" → Open the official judiciary service yourself
- Caller from "the bank" wants your dynamic password → Hang up and call the number on your card
- Deposit SMS, then a request to send it back → Check your real balance in the bank app
- Friend's account asks for urgent money → Call your friend by voice first
- SMS: "Pay the customs fee for your parcel" → Track the parcel on the official postal service
The one move behind all of these
- Never act through the channel the message or call gave you. Switch to a channel you choose: the official app, the number on your card, a voice call to your friend.
- Codes, PINs, CVV2 and dynamic passwords are for typing into your own payment pages, never for reading out to anyone.
- Urgency is a signal to slow down. Nothing real is lost by taking ten minutes to check.
Check yourself
Shirin gets a call: "This is your bank's security unit. Someone is trying to withdraw money from your card right now. To cancel it, read me the code we're sending you." What should she do?
- Read the code quickly, since every second counts
- Ask the caller to confirm her card number first, then read the code
- Give only the first three digits of the code to be careful
- Hang up and call the bank on the number printed on her card
Show the answer
Hang up and call the bank on the number printed on her card
Exactly. The code she'd read out is most likely the one that approves a payment or a login. Calling back on her card's number reaches the real bank, and if there's a real problem they'll handle it.
Lesson recap
- A sender's name, number or account can be faked or hijacked.
- Court notices, fines and parcels can always be checked on the official service, never through the SMS link.
- Banks don't ask for your PIN, CVV2 or one-time codes by phone; hang up and call back.
- Check deposits in your bank app, and call a friend by voice before sending money.
- The move that beats them all: switch to a channel you choose yourself.