When a customer receives a scam text pretending to be your business, the first question lands with you: “Is this from you?” Someone pastes a message about a delivery fee or a refund and asks whether to tap the link. Your team cannot stop those texts from being sent, but it can give the customer a clear answer within a minute instead of an hour of guesswork.
This guide covers the support side: a ready-made reply, a public page explaining how you contact customers, a rule about what you never ask for, and a way to log reports. Official reporting channels for Poland, the UK, the US and Germany are at the end. All companies in the examples are fictional.
A customer asks whether the text is from you: the first reply
The customer needs three things, not a security lecture: whether the message came from you, what to do now, and where to check their order without using the link. If you are not sure whether it was your message, do not guess. Say you are checking and ask them not to open the link in the meantime.
“Thanks for checking before you tapped anything. This message did not come from us: we never text links to pay extra fees, and we never ask for a text message code, PIN or card details. Do not open the link. You can check your order by typing our shop address into your browser and signing in to your account. In the UK and US you can forward the text to 7726. If you have already entered card details, contact your bank immediately.”
Adapt the template to what you actually send. If your shop texts delivery updates, describe them: which sender name they use and that they never ask for payment. Save it as a shared template; see the guide to customer service response templates.
What to check in the report before you answer
Ask for a screenshot or the copied text, but never ask the customer to pass on a clickable link or the details they typed into a fake site. Do not open the link on a work computer, not even “just to look”. The sender, the text and the visible address are enough to judge it. An example from a fictional bike shop:
Scroll the table sideways to see all columns.
| Signal in the message | What it means for support | What to reply |
|---|---|---|
| Link to a domain other than your shop | Almost certainly impersonation | Not us, do not tap, check the order in your account |
| Request for a fee, code or card details | Breaks your published rule | We never ask for this; if details were entered, call the bank |
| Correct order number or first name | Possible leak or a guess, escalate to the owner | We are checking and will reply in this conversation |
| Sender name matches yours | Does not prove the message is genuine | The content and address matter, not the sender name |
The third row needs its own path. If the fake message contains real order details, hand the case to whoever is responsible for data protection, and do not speculate about the cause in front of the customer. Sender names prove nothing about identity; see the guide to verifying customer identity on orders.
A public article: how we contact you
The fastest answer is one the customer never has to ask for. Publish a short “How we contact you” article and link it from your footer, order confirmations and support replies. Be specific: “we never send payment links by text” gives the customer a test, while “we take security seriously” gives them nothing.
- Your website address and the domains your emails come from.
- The sender name of your texts, if you send any, and their only purpose.
- Data you never request: text message codes, PINs, passwords, full card numbers.
- A note that extra charges on an order only appear after signing in to the shop account.
- A safe way to check a message: the chat on a page opened from a typed-in address.
- The date the article was last updated.
In Meetlead customer support you can publish this text as a Help Center article in Polish, English and German, and customers will find it through the widget search on your site. With Meet AI active, a published article also becomes a knowledge source for the assistant, so its answers about your channels match the page. More in the guide to website knowledge bases and FAQs.
The “we never ask” rule has to hold in chat too
A public promise only works if your team keeps it. If your article says you never ask for a text message code or card details, an agent cannot ask for them “just this once” to close a case faster. Every exception teaches customers that a code request from “the shop” can be real, and scammers rely on exactly that.
Some worried customers still paste a card number or code into the chat to “prove” who they are. That moment needs its own procedure, described in the guide on sensitive data pasted into chat. Here, one sentence in the template is enough: “We do not need these details, so please do not send them to us or to anyone claiming to be us.”
One tag to reveal a campaign
Five similar questions in one afternoon suggest that someone is texting a larger group in your name. To notice, label every such conversation the same way.
- Create one tag.For example “impersonation-sms”, not one tag per message variant.
- Record details in a note.Time received, sender name, the message theme and the link domain, without the customer’s personal data.
- Watch the number of tagged conversations.Filter the inbox by the tag daily; a sudden rise means updating the article.
- Pass on the collected domains.The person who reports fake sites gets the list of addresses.
Meetlead does not detect phishing or send text messages, but in the inbox you can tag a conversation, see the tag’s usage count and filter by several tags at once. The guide to tagging conversations and tickets shows how to name a tag so it outlives a single campaign. When questions arrive in a wave, a shared fact sheet and a fixed update rhythm help, as in coordinating customer updates during an incident.
Where to report scam texts and fake sites
Give the customer one channel that fits their country, and report the fake sites you collected from conversations yourself. Anyone who lost money should contact their bank first, then the police. The channels below come from official pages; recheck them before publishing.
Scroll the table sideways to see all columns.
| Country | Scam text | Fake site or lost money |
|---|---|---|
| Poland | Forward the text to 8080 (CERT Polska), free within Poland | The incydent.cert.pl form; if money was lost, the bank and police |
| United Kingdom | Forward the text to 7726, free of charge | Report the site to the NCSC; if money was lost, Report Fraud or Police Scotland |
| United States | Forward the text to 7726 (SPAM) | A complaint at ReportFraud.ftc.gov |
| Germany | A complaint to the Bundesnetzagentur about an unsolicited text | If money was lost or card details were entered, the bank and police |
The 8080 number and the incydent.cert.pl form are described in the Polish government’s gov.pl knowledge base, and 7726 and site reporting in the UK by the NCSC. They explain where to report, not how fast a campaign will be stopped.
The FTC consumer alert of 24 July 2025 about fake Amazon “refund” texts points to 7726 and ReportFraud.ftc.gov. Germany’s Bundesnetzagentur accepts complaints about unsolicited texts. None of these sources describes the duties of a shop whose name was misused.
This text is not legal advice. If the fake message contained real customer data, assess with whoever handles data protection whether a breach occurred and what obligations follow.
Questions about scam messages using your shop’s name
Should we warn all our customers? Check the scale with the tag first. One or two reports can usually be handled with the reply template and the contact policy article. If they pile up, a short notice on your site and in your newsletter makes sense, as long as it repeats the article’s rules. Never put a link that asks for personal details in the warning.
A customer already paid on the fake site. Does the shop have to refund them? The money went to the scammers, not to your shop, so this is not a refund for your order. Reply with empathy, point the customer to their bank and the police, and confirm whether their real order is fine. Any goodwill gesture is the owner’s decision, not the chat agent’s.
