Did I just get an FBI warning phishing text on my Android/iPhone?

General
1

I just received a scary message on my phone claiming to be an official FBI warning, saying my device is under investigation and I must click a link or respond or I could face legal trouble. It looks suspicious, but I’m worried because it mentions my Android/iPhone specifically and uses official-sounding language. How can I tell if this is a phishing scam, what should I do next, and is there any way to report it safely without putting my data at risk?

2

Yeah, that is a phishing / scam text. The FBI does not contact you on your personal phone with a random SMS link and threats.

Quick checks you can do:

  1. Look at the sender
    • Weird short code, random email address, or foreign number = scam
    • Government agencies in the US do not initiate legal action by text

  2. Look at the content
    Common scam signs:
    • Threats like “your device is under investigation” or “legal action in 24 hours”
    • Demands to click a link, reply, pay a fine, or provide personal data
    • Bad spelling or grammar, odd phrasing, generic “Dear user”

  3. Do not
    • Do not click the link
    • Do not reply STOP or anything
    • Do not call any number in the message
    • Do not give personal data, passwords, SSN, bank info, etc

  4. What you should do right now
    • Delete the message
    • Block the sender
    • If you tapped the link, run a malware scan

    • Android: use Play Protect and a reputable antivirus app
    • iPhone: check for strange profiles in Settings > General > VPN & Device Management
      • Change passwords if you entered any info after clicking
      • Enable two factor authentication on your main accounts

  5. Report it if you want
    • Forward the text to 7726 (SPAM) from most US carriers
    • Report to the FBI Internet Crime Complaint Center: ic3.gov
    • You can also report to ftc.gov if the message involved money or fraud

Example of what real law enforcement does:
• Formal letter, in person visit, or a call from a verifiable number after an ongoing case
• No threats over SMS to click a random link to “avoid arrest”

If you did not click anything, you are fine.
If you clicked but did not enter data, risk is lower, still run a quick check on your phone.
If you entered data, treat that data as compromised and change things fast.

3

Yeah, that’s absolutely a scam, and frankly not even a very creative one.

@hoshikuzu already covered the basics really well, so I’ll skip the “don’t click it / block it / report it” checklist and add a few extra angles so you can sanity‑check this yourself next time without freaking out.

  1. How the real FBI actually contacts people

    • They build a case quietly. If they’re at the point of “you’re under investigation,” they already have what they need. They are not trying to “warn” you by text.
    • Contact is usually:
      • In person (agents showing up)
      • A phone call you can verify by looking up the office number yourself
      • Certified mail / official letters
    • They do not:
      • Say “click here to avoid arrest”
      • Ask for fines via gift cards, crypto, or random links
      • Use generic phrases like “your device is under investigation” with no case number, no names, no details.

  2. Psychological tricks they’re using on you
    Scammers lean on:

    • Fear + urgency: “respond in 24 hours or legal action”
    • Authority: Slapping “FBI” or a seal image in there
    • Confusion: Tech-ish phrases like “your device has been flagged” or “illegal content detected” but with zero specifics
      If a message tries to rush you and scare you, slow down on purpose. That pause is your best defense.

  3. What to do if you already interacted a bit
    This is where people panic, so here’s the calmer breakdown:

    • You only read it, did nothing else:

      • You’re fine. SMS itself can’t hack your phone. Just delete & block.

    • You clicked the link but closed it immediately, entered nothing:

      • Risk is low.
      • On Android: update system + apps, make sure Play Protect is on.
      • On iPhone: update iOS and watch for weird configuration profiles or VPNs you didn’t set up.
      • Keep an eye out for strange behavior (popups, new apps, battery drain).

    • You entered login details (email, bank, social media, etc.):

      • Change those passwords immediately from a different device if possible.
      • Turn on 2FA for those accounts.
      • Check account activity / login history where available and log out of other sessions.

    • You entered really sensitive info (SSN, bank card, etc.):

      • Call the bank/card issuer and tell them your info was phished. They deal with this constantly.
      • For SSN in the US: consider monitoring credit or a fraud alert with credit bureaus. Overkill for most SMS scams, but if they explicitly asked for SSN, treat that seriously.

  4. A quick self-test to calm your brain next time
    When you get something scary like this, ask yourself three things:

    • “If this was real, would they really use this method?”
      Law enforcement: no, not via random SMS link.
    • “Who benefits if I rush?”
      Real agencies don’t need you to act in 5 minutes. Scammers do.
    • “Can I verify it without using anything in the message?”
      That means:
      • Don’t use their link.
      • Don’t call their number.
      • Instead, Google “FBI field office [your city]” and call that number directly if you are still worried. They will either laugh or tell you straight that it’s a scam.

  5. Specific to Android vs iPhone
    People love to say “iPhones can’t get hacked” and that’s… not really accurate.

    • Android:

      • Bigger target for malicious APK files if you install stuff from weird links.
      • If you ever downloaded an app from a link in a text, uninstall it and only use Play Store.

    • iPhone:

      • You’re less likely to get drive-by malware, but scams that steal passwords are identical on both.
      • Watch out for fake “Apple ID” pages that look legit. Always check the URL at the top very carefully.

  6. When to actually worry law enforcement might contact you
    Leaving scams aside, people sometimes spiral into “wait, what if I actually did something illegal online accidentally?”
    In real cases, you’re going to see things like:

    • Subpoenas, warrants, or letters sent to your address
    • Your ISP or a company contacting you referencing a specific case number or incident
    • Real officers/agents, not anonymous texts
      Not: random, vague messages with zero details and a magical link that fixes everything.

TL;DR:

  • Yes, it’s a phishing scam.
  • No, the FBI is not sitting there texting you like a spammy newsletter.
  • If you didn’t click: delete & move on.
  • If you did click or gave info: clean up calmly, change passwords, lock down accounts, and treat it as a lesson, not a life-ending event.

You’re definitely not the only one who’s gotten a message like this. The fact you stopped and questioned it instead of blindly tapping is already you doing it right.

4

Yeah, that text is garbage, but let me give you a different angle so you can future‑proof yourself a bit rather than just reacting each time.

1. Think in “channels of trust,” not just “this one message”

Instead of memorizing scam patterns, build a rule for your brain:

  • Anything involving:
    • criminal accusations
    • money
    • passwords or verification
      that arrives via SMS, random email, or popup starts at 0% trust.
  • You only increase trust by independently verifying through:
    • official websites you type in
    • phone numbers you look up
    • in‑person or physical mail that you can cross‑check.

If a message cannot survive that independent verification, you treat it as noise.

2. Why “but what if it’s actually about illegal content on my phone?” is the wrong question

Scammers feed on that little “what if I actually did something?” doubt.

Reality:

  • If law enforcement is serious, they are collecting evidence quietly.
  • When they act, they do not:
    • warn you through a link
    • offer you a magic “resolve this now” button
  • There is no workflow where an agent types:
    “Your phone is under investigation, click to clear yourself.”

So the question to ask is not “what if it’s real,” but “does this look like how serious people handle serious things?”
For a legal process, that answer is always no for unsolicited SMS.

3. One practical habit: never engage with the same channel the threat used

This is where I slightly differ from @shizuka and @hoshikuzu on “what to do next”:

  • They are right about not clicking/replying/calling their numbers.
  • I’d go a step further:
    Never resolve a scary message using the contact info or links inside that message.
    Not even for reporting or “STOP” or “unsubscribe.”

Example:

  • Scary “FBI” text arrives.
  • If you are still anxious, close Messages entirely.
  • Then:
    • Use a browser, search for the public contact of your local field office or national hotline.
    • Call that number and explain you got a suspicious text.
      Anyone legit will tell you immediately that it is not how they operate.

This habit also protects you from future IRS, bank, PayPal, and “your kid is in jail” scams that use the same trick.

4. How to mentally label these messages so they lose power

Instead of seeing:

“Your device is under investigation…”

Train yourself to see:

“An anonymous stranger with unknown motives is trying to provoke a fear reaction to get me to act quickly.”

That mental reframing does two things:

  • Removes the “FBI” halo effect.
  • Reminds you the sender has zero verified identity.

Fear is the product they are selling; your calm is the firewall.

5. If you are worried you already exposed something, think in “layers”

Ignore the specific scam for a second and do a quick mental audit:

  • Device layer
    • Did you install any app from outside the official store?
      • Yes: uninstall, consider a backup + factory reset on Android if anything seems off.
      • No: you are mostly dealing with phishing, not deep compromise.
  • Account layer
    • Any login you typed after clicking that link (email, banking, social) is now untrusted.
    • Reset those passwords from a clean device, and turn on 2FA.
  • Identity / financial layer
    • If you typed card numbers, contact the card issuer.
    • If you typed ultra‑sensitive stuff like SSN, freeze or monitor credit.

You do not need to nuke everything from orbit if you only read the SMS and closed it, but if you did feed it info, treat each “layer” separately rather than just panicking in one big blob.

6. About relying on “look for bad grammar”

People say this a lot, and @shizuka did mention content checks. It is partially helpful, but I would not lean on it heavily:

  • Modern scams can be very polished.
  • Official messages can sometimes be written poorly or tersely.

So grammar is a weak signal.
Much stronger:

  • Does it demand speed?
  • Does it mix legal threat + clickable link?
  • Does it come through a casual, insecure channel like SMS?

If yes to those, grammar does not matter; it is already in the “trash until proven otherwise” bucket.

7. Comparing approaches

  • @hoshikuzu gave a great breakdown of psychological tricks and device‑specific tips. Good for understanding why it works.
  • @shizuka focused on straightforward checks and reporting paths. Good for a quick checklist.

Where I add to that:

  • Build “channel rules” so you do not need to re‑evaluate each scary message from scratch.
  • Use independent verification as your default move, not just blocking and forgetting.
  • Treat SMS‑based threats involving law enforcement or banks as categorically untrustworthy unless disproven by real‑world contact.

Once you start thinking this way, your brain stops spiking every time some fake agency “investigates” your phone.

Bottom line:
The text is not real, the FBI is not investigating your phone over SMS, and the right long‑term fix is to treat any serious‑sounding demand arriving via random text as guilty until independently proven innocent.