CALIFORNIA — October 20, 2026. The message looks like it came from a familiar bank, online retailer, delivery service or government agency. It tells you that a parcel could not be delivered, your account is suspended, or a fee must be paid immediately. Yet the link leads somewhere you have never been before. This is how many phishing schemes begin.
CALIFORNIA58 · CONSUMER SAFETY
FAMILIAR BRAND.
UNFAMILIAR LINK.
DELIVERY?ACCOUNT?VERIFY DIRECTLY ✓
Original symbolic California58 illustration, not a reproduction of a company’s message or an image of a real incident. No third-party photo was used.
Fraud by email is widely called phishing; by SMS, it is often called smishing. Criminals imitate brand names and designs to obtain money, passwords, credit-card numbers, identity details or one-time security codes. Many fraudulent messages are now polished enough that spelling mistakes alone are not a dependable warning.
The Federal Trade Commission advises contacting a company through a website or phone number you know is genuine, instead of trusting an unexpected email’s links or contact details. California government agencies have issued similar alerts.
Five familiar disguises
1. “Your package cannot be delivered.”
A text claiming to be from USPS or a delivery company says your address needs updating, often with a small “redelivery” fee. The apparent low cost can conceal an attempt to steal card information. Use the carrier’s known website or app instead of a message link. The Postal Inspection Service’s smishing guide explains how to report these messages.
2. “Your bank or shopping account is locked.”
An email can appear to come from a familiar payment provider, retailer or streaming service. It may threaten suspension, claim an unusual login, or request a security code. Even when the sender’s display name looks right, it does not prove that the underlying domain or linked site belongs to the company. Open the real app independently. For banking concerns, use the phone number on your card.
3. “DMV: your license will be suspended.”
California DMV warns that its name is used in fraudulent emails, texts, calls and social media ads. The agency states that it will not request personal or financial information by text and does not send texts with links to pay. To verify a genuine account issue, type dmv.ca.gov into the browser yourself.
4. “You owe an unpaid toll or court fine.”
Messages may impersonate FasTrak, a county court or a state agency and threaten additional penalties unless you pay immediately. Bay Area FasTrak says it does not request payment by text containing a website link. The California Attorney General has warned of fake court notices demanding payment for traffic or toll violations. Never assume an unsolicited link identifies a real debt.
5. “Your tax refund is waiting.”
Some scams impersonate government tax agencies to collect banking details or login credentials. The California Franchise Tax Board advises residents not to open suspicious links or attachments. Legitimate offices may sometimes send notifications, so the safest method is to independently enter the official government website and check there.
Seven questions to ask before clicking
- Was I expecting this? Unexpected contact calls for independent verification.
- What is the actual sending address? A display name or logo is not proof.
- Where does the link lead? Lookalike domains, strange paths and shortened links deserve suspicion.
- Is there manufactured urgency? Instant suspension and threats are common pressure tactics.
- Does it ask for a password or one-time code? Never give a sign-in verification code to a stranger.
- Is there an attachment or QR code? These can also point to fraudulent websites.
- Can I verify through my own bookmark or official app? If so, do that instead of using the message.
A padlock symbol is not proof of legitimacy. HTTPS encrypts the connection; a criminal can also operate a fraudulent website with HTTPS. Likewise, modern phishing messages may be free of obvious spelling errors.
What to do if you already followed the link
If you opened a suspicious page but entered nothing, close it without downloading anything. If you downloaded a file, update your security software and scan your device. If you entered a password, immediately change it through the legitimate service, review logged-in devices, sign out unknown sessions and enable multifactor authentication. Secure the email account used to recover other accounts.
If you entered banking or card details, promptly contact the institution using the number on your card, explain what happened, and request protective measures. If you exposed Social Security numbers or other identity information, start with IdentityTheft.gov. Keep transaction records and screenshots that do not expose more sensitive information publicly. Be wary of people who demand a second fee to “recover” stolen money.
Where to report fraudulent messages
- General fraud: ReportFraud.ftc.gov.
- Phishing email: forward to reportphishing@apwg.org or use your email service’s report feature.
- Suspicious SMS: forward to 7726 (SPAM), where supported.
- USPS impersonation: send relevant reports to spam@uspis.gov following Postal Inspection Service instructions.
- DMV impersonation: consult the state’s scam alert.
What families and small businesses should do
Set a household rule: no one gives an unsolicited caller or sender a one-time verification code. Have a trusted method for checking unusual requests from relatives. Business owners should confirm changes in a vendor’s payment instructions by calling a previously verified phone number, not one supplied in a new invoice email. Training staff to verify independently matters more than teaching them to look only for bad grammar.
A local newspaper warning should also avoid spreading the scam itself: do not publish clickable malicious URLs, expose a victim’s contact details, or make a fictional sample look like an authenticated screenshot. Describe suspicious techniques precisely and point readers to official reporting channels.
Sources, transparency and further reading
This is an original California58 consumer-protection explainer, not a claim that any particular well-known company sent the example messages. Its core safety advice reflects the FTC, U.S. Postal Inspection Service, California DMV, California Franchise Tax Board and California Attorney General. The banner graphic is conceptual, not a photograph or verified screenshot.
See California Life, California58 News and Editorial Standards for related information. Support independent California58 journalism.
Support independent journalism for all Californians
Support reporting, public information and community coverage across California’s 58 counties.
Donate once by card ↗Support California58
Choose how to support California58:
Credit / Debit Card via StripeChoose an amount from $1. One-time support through the publisher's LINKERNO Stripe account.
Continue with PayPal Continue with ZelleZelle payments go to Vitaly Ataev Troshin. Please verify the recipient in your bank before sending. Availability depends on your bank.
Optional reader support. Contributions are not advertised as tax-deductible. Support does not influence editorial decisions.USEFUL SERVICES
Useful services from our ecosystem
AFFILIATED RESOURCE
Travel smarter worldwide
OptionTripAI-powered trip planning for journeys in California and around the world.
Explore OptionTrip →AFFILIATED RESOURCE
Free tax & property tools
TaxesTimeFree preliminary tax and property tools, including the Property Tax Savings Report.
Explore TaxesTime →AFFILIATED RESOURCE
California document support
LegalDocSVCDocument preparation support for self-represented Californians. Not a law firm and not legal advice.
Explore LegalDocSVC →WORK WITH CALIFORNIA58
Have a story, project or partnership idea?
California58 welcomes news tips, interviews, video projects, community partnerships, advertising and other California-focused collaborations.
Work with California58 →
COMMUNITY
Comments
Join the California58 conversation. You must be signed in to comment.
Create a free California58 account or sign in with an available social provider.