I Clicked a Link in a Spam Text on My iPhone. Now What?

TL;DR

• Clicking a link in a spam text on your iPhone almost never installs anything on its own, because iOS keeps every app and web page walled off from the rest of the phone.
• The real damage happens at the next step, when the fake page talks you into typing a password, card number, or verification code.
• If you only opened the page and closed it, you’re very likely fine. Close the tab, don’t enter anything, and move on.
• If you typed a password or card details, change that password now and call your bank now, before you finish reading.
• Check Settings for any configuration profile you didn’t install, then forward the text to 7726 and delete it.

You tapped it. You clicked a link in a spam text, maybe one saying your package couldn’t be delivered or there was an unpaid toll, and for half a second it looked real enough that your thumb moved before your brain did. Now the page is open and your heart is going. Did you just hand your phone to a scammer?

Almost certainly not from the tap alone. Take a breath. What matters next is whether you did anything on that page, and there’s a short, specific list of things to check.

What actually happens when you click a link in a spam text

Here’s the part nobody tells you while you’re panicking. On an iPhone, opening a web page is close to harmless by itself. Apple runs every app and every browser tab inside its own sealed box, a design called sandboxing, so a random website has no path to reach into your other apps, read your messages, or quietly install software. Security researchers who cover iOS keep repeating the same thing: most mobile threats need you to take an action, not just load a page.

Yes, “zero-click” attacks that compromise a phone with no tap at all do exist. They’re real. They’re also expensive, rare, and aimed at specific people like journalists and dissidents, not sprayed across millions of numbers in a fake toll text. If you got the same “unpaid toll” message half your contacts got, you were not the target of a nation-state exploit. You got a phishing lure, and phishing only works if you feed it.

So the question isn’t “did I open it.” It’s “did I give it anything.”

The real risk is the next screen, not the link

Phishing pages have one job: get you to type something. That’s where a harmless tap turns into an actual problem.

The page usually looks like a login you recognize. A delivery company, your bank, Apple, a toll authority. You enter your password, and it lands directly in the scammer’s hands. Worse, some pages then ask for the six-digit code your real bank or Apple account just texted you. Hand that over and they can walk straight past two-factor protection while you’re still sitting on the fake page.

Card details are the other common ask. “Pay the $2.99 toll to release your vehicle.” The amount is tiny on purpose, small enough that you stop scrutinizing and just type your card number to make it go away. Now they have the number, the expiration, and the security code.

There’s one more path worth knowing about. On iOS, a site can prompt you to install a configuration profile, which is a legitimate tool companies use to manage work phones. In the wrong hands it can reroute your traffic or install apps. The saving grace is that it can’t happen silently. You have to tap through several prompts and approve it in Settings yourself. If you never saw a “Profile Downloaded” message and never went digging in Settings to install anything, you don’t have one.

What to do right now, based on what you did

Match your situation to one of these and act on it.

You only opened the page and closed it. You’re in the clear on the most likely outcomes. Close the tab, clear it out of your mind, and skip to the reporting step below. No, you don’t need to factory-reset your phone.

You typed a password. Change it immediately on the real account, and change it anywhere else you reused that same password, because scammers try stolen logins across dozens of sites. Turn on two-factor authentication if it isn’t already on. Do this part before you finish the article.

You entered a verification code too. Assume they tried to get in the second you gave it up. Change the password, then open the account’s security settings and sign out any devices or sessions you don’t recognize. Confirm two-factor is still pointed at your own number. For a walkthrough of this exact cleanup on an Apple account, see our guide on the Apple ID locked text scam.

You entered card or bank details. Call the number on the back of your card now and tell them it may be compromised. Ask them to watch for fraud or reissue the card. Then keep an eye on your statement for the next few weeks. Small “test” charges of a dollar or two often come before a big one.

You downloaded or installed something. iOS won’t run a random app from a website, but if you approved a configuration profile, remove it. The steps are in the next section.

Check for a sneaky configuration profile

This takes thirty seconds and it’s the one hidden thing worth ruling out. Open Settings, tap General, then scroll down and look for a line called VPN & Device Management (on some phones it reads Device Management, and if the line isn’t there at all, you have no profiles, which is good news). Tap in. If you see a profile you don’t recognize and didn’t add for work or school, tap it and choose Remove Profile. While you’re in Settings, install any pending iOS update. Those updates patch the exact holes attackers try to use.

Stop the next one from ever reaching you

Clicking happens because the text got to you in the first place, usually at a bad moment when you were distracted. The most reliable fix isn’t training your thumb to be faster. It’s cutting down how many of these ever hit your screen.

Blocking the sender does almost nothing here, because the next text arrives from a fresh number or a throwaway email address. Apple’s built-in Filter Unknown Senders helps a little but misses a lot, which we broke down in why filtering unknown senders isn’t enough. That gap is why we built Not Today. Instead of chasing individual numbers, it filters on the content and the patterns these scams reuse, so a fake delivery or toll text gets caught before it reaches you even when the sender changes every time, and it checks incoming numbers against a community database of reported spammers. Fewer of these on your lock screen means fewer 11pm moments where your thumb moves first.

Report it, then get on with your day

Reporting is quick and it genuinely helps shut these down. For a spam text, forward the message to 7726 (that spells SPAM), which sends it to your carrier’s spam team. On iMessage from an unknown sender, you can also tap Report Junk under the conversation. Then report the scam itself to the FTC at ReportFraud.ftc.gov, which feeds the data behind those scam alerts you see.

Then delete the text and let it go. Fake package-delivery messages were the single most reported text scam of 2024, part of the $470 million Americans lost to text scams that year, more than five times the total from 2020. You are not careless for tapping one. They are engineered to be tapped. The only thing that matters now is that you didn’t feed the page, or that you caught it fast and changed the password. Either way, you handled it.

---

Not Today is a free spam-blocking app for iPhone. We built it to catch spam before it reaches you, using keyword rules, a community database of reported numbers, and optional AI detection. No account required. Download on the App Store.