You roasted the scammer. They confirmed your number works.

Replying to a fraudulent text may feel satisfying, but it can validate an active number and open the door to a more convincing con. In Cyprus, the bait increasingly resembles an unpaid fine, a missed delivery or expiring loyalty points. There is something deeply satisfying about receiving a scam text and deciding that, today, you have time. Perhaps you correct the spelling. Perhaps you pretend to be a police officer, send a ridiculous photograph or inform the sender that their unpaid toll has been transferred to the Ministry of Absolutely Not. For a brief and glorious moment, the criminal has become your entertainment. Except the scammer does not care that you are funny. The scammer may not even be personally reading the first message. What matters is that you replied. That one sarcastic answer confirms that the telephone number exists, is monitored and belongs to somebody willing to engage with an unfamiliar sender. Congratulations. You may have just completed a free data-cleaning exercise for a criminal. The FTC’s warning is blunt, even a short reply tells scammers that they have reached a working number, which can result in more fraudulent calls and texts. Your joke may end the immediate conversation. It can also make your number more useful for the next one. This type of fraud is known as “smishing”, a slightly silly word for something that can empty a very real bank account. It combines SMS messaging with phishing and usually begins with a small disturbance designed to interrupt an ordinary day. Your parcel cannot be delivered. Your card has been suspended. A payment is waiting for approval. Your toll is overdue. Someone called Elena, not her real name, wants to know whether you are still meeting for dinner. The message does not always need to be convincing. Sometimes it only needs to be irritating, alarming or strange enough to make you answer. “Wrong number” texts are particularly effective because replying feels harmless, even polite. You tell the sender that they have made a mistake. They apologise. Then they continue talking. They ask where you live, what you do or whether you have ever considered investing in cryptocurrency. The Federal Trade Commission says this apparently accidental contact can be the beginning of a much longer fraud, with the sender gradually building familiarity before introducing an investment opportunity or another way to make suspiciously easy money. And that is the clever part. The first message is not necessarily the scam. The first message may simply be the knock on the door. Once you respond, the sender can begin collecting useful fragments. The language you use, the time you answer, your tone and any personal detail casually included in the conversation can help shape the next approach. A person who jokes may be curious. A person who becomes angry is still paying attention. A person who explains that they are waiting for a parcel has just supplied the scammer with a better story. Scammers do not need a complete biography. They need enough information to sound slightly less like strangers next time. In Cyprus, they have already learnt to speak fluent bureaucracy. The local versions arrive disguised as unpaid traffic fines, Cyprus Post delivery problems, GESY updates, tax refunds, social-insurance payments and loyalty points that are apparently about to expire at the precise moment you are tired, distracted and holding three shopping bags. In May, police issued a public warning about messages claiming that recipients had unpaid traffic tickets. The texts directed people to links for supposed out-of-court payments, with authorities saying the objective was to obtain personal information, banking details and money. The warnings have not gone quiet. On July 3, the Cyprus cybercrime subdivision said it had received multiple complaints about scam calls and messages impersonating automated payment-service operators. In one case, a resident was told that approximately €200 was about to be deducted from an account. Authorities said similar complaints had been arriving for months, warned that further attempts were likely and asked the public to forward suspicious messages, emails and links for investigation and blocking, according to the latest warning. Only a day earlier, police disclosed that an 83-year-old woman in Nicosia had lost more than €127,000 after a caller posing as an employee of an online financial and payments platform persuaded her to reveal banking information. Although the approach began with a call, the official notice also warned people never to enter financial details into links delivered through SMS, Viber, WhatsApp or email. Different opening line, same objective: make the target participate. The scam begins to work when it stops being a message and becomes a conversation. The timing of these messages is part of their strength. A driver may genuinely wonder whether a camera caught them speeding. Someone expecting an online order may assume a €1.99 delivery charge is inconvenient but plausible. Nobody wants to spend the afternoon telephoning a government department or courier company over such a small amount, so paying it feels easier. Of course, the €1.99 is rarely the real prize. The fake page may request a card number, online-banking credentials, a verification code or a one-time password. Once those details are entered, the scammer has something far more valuable than a delivery charge. Current fraud alerts from the Bank of Cyprus (BoC) describe messages impersonating courier companies and Cyprus Post, as well as texts offering Antamivi gifts in exchange for a small delivery fee. Other versions promise supermarket or petrol-station rewards, demand payment for an overdue police fine or ask customers to update their the national healthcare system (Gesy) profile. There are also supposed tax refunds and social-insurance payments because, apparently, criminals know that nothing lowers our defences quite like the government unexpectedly offering to give money back. The BoC says it will never send an SMS containing a link. Cyprus Post has also issued an official warning about fraudulent messages asking recipients to correct delivery addresses. Still, checking the sender’s name is no longer enough. Cyprus Police’s cybercrime advice warns that scammers can make a message appear to come from a genuine service. A fraudulent text may even be placed by the phone inside the same conversation thread as authentic messages from the organisation. It looks official because your phone has filed it neatly. Your phone, regrettably, is not conducting an investigation. The consequences can be brutal. In July 2025, a 32-year-old woman in Cyprus received a text telling her to pay a fine immediately. She followed the link, entered her bank-login details and supplied a one-time password. Scammers then withdrew €14,085 from her account, according to the reported case. The one-time password did not fail. It performed exactly the task for which it had been created: approving an action. The bank could not see that its customer had been frightened into handing the code to somebody else. This is why a request for a verification code should end the interaction immediately. No police officer, postal worker or genuine bank employee needs you to read out an OTP to cancel fraud, release a parcel or protect your savings. Security codes approve things. They do not magically undo them. Nor should you reply “STOP” to an obviously fraudulent message. That instruction belongs to legitimate marketing services. The US Federal Communications Commission’s consumer guidance specifically advises people not to respond to suspicious texts even when the message invites them to send “STOP”. The safest response is painfully unexciting: do nothing. Do not answer. Do not click. Do not telephone the number inside the message. If the claim could be genuine, open the organisation’s official app, type its known website into the browser or call a trusted number from a bank card, bill or official document. Then report the message as junk, block the sender and notify the organisation being impersonated. In Cyprus, reports can be made through the CyberAlert portal, while the cybercrime subdivision lists +357 22808200 and [email protected] as contact details. If you have only replied, there is no reason to panic. Stop the conversation and expect the possibility of further attempts. If you entered banking details, a password or an OTP, however, contact the bank immediately. Freeze the relevant card if possible, review transactions and replace any password reused on another account. That urgency is also reflected in official recovery guidance from Britain’s national cyber security centre. Professional scam-baiters may waste criminals’ time using isolated devices and false identities. Your personal phone, attached to your real name, accounts and daily life, is not an isolated laboratory. So yes, your response was clever. The meme was excellent. The scammer is devastated. They also now know your number works. Sometimes the most irritating thing you can give a scammer is absolutely nothing.