Text message short codes, explained

A short code is the five- or six-digit number some businesses text from instead of a normal phone number: bank alerts, delivery updates, two-factor codes, appointment reminders and marketing lists. In the United States they are leased through the industry registry that iconectiv runs under the CTIA short-code programme, and they cost roughly $500 a month for a random code or $1,000 for a chosen one, on terms of three months and up. That price and the vetting behind it are the reason a code is a mild trust signal: it is expensive to hold and easy to take away.

Usually because a company you actually deal with sends through a code you have never noticed, or because a list you joined was sold on. Sometimes it is a service texting on behalf of a brand, so the name in the message and the owner of the code are different. And sometimes it is not a short code at all: plenty of scam texts arrive from ordinary ten-digit numbers or from email-to-text addresses, which look unfamiliar for the simple reason that nobody has ever used them before.

Text the word HELP to it. Every compliant US short code has to answer with the programme name and a way to reach support, either a toll-free number or an email address, and the reply itself tells you who is behind the code. Then verify that answer independently: open the company’s site or app from your own bookmark, or call the number on the back of your card, and confirm the message there. What you should not do is tap the link in the text to check, which is exactly the action the fake ones are built around.

To a genuine short code, yes, and it is the fastest way out. The industry rules require the sender to drop you from the list on STOP, CANCEL, UNSUBSCRIBE, END or QUIT, and to send at most one confirmation afterwards. To an unknown ten-digit number sending obvious scam texts, no: there is nothing obliging them to stop, and a reply tells them a real person reads that line, which raises its value on the next list. Delete, report and block those instead.

It happens, but it is not the common case, because leasing a code means paying monthly and passing a review that a fraud campaign rarely survives for long. Two things are far more frequent: a scam sent from an ordinary number or an email gateway that merely looks official, and a real short code that has been quoted inside a fake message so the text appears to come from your bank. Judge the demand rather than the sender — a link asking you to log in, confirm a payment or read back a code is the warning sign whatever number carried it.

It spells SPAM on a keypad, and it is the reporting channel the major US carriers share. Forward the scam text to 7726 and your carrier’s spam team gets the content and the sending number, which feeds network filtering and can get the sender cut off. It works on a threshold, so one report rarely does anything on its own and the numbers rotate quickly. Report to the FTC at reportfraud.ftc.gov as well if money or personal details were involved.

Opt out of the real programmes with STOP, report the fakes to 7726, and turn on filtering: “Filter Unknown Senders” in iPhone Messages settings, or spam protection in Google Messages on Android. That handles what is already arriving. The reason new senders keep finding you is that your number is published and resold, so the durable fix is the same one that works for spam calls — get the number off the people-search sites and broker databases carrying it, then keep it off.

No reliable one. Codes change hands as leases end, the third-party “short code lookup” lists that rank in search are mostly stale copies of each other, and several are people-search sites collecting your details in exchange for an answer. Texting HELP to the code gives you a current answer from the sender itself, which beats any list.