All articles

September 24, 2026

Is That Product Recall Text Real or a Scam?

A text arrives. It looks like it came from Amazon, or Costco, or Walmart. It says an item you ordered has been recalled for a safety problem, and that you are owed a full refund. All you have to do is sign in through the link and review your order.

And the awful part is that it half makes sense. You did order something recently. Most people did.

So before you tap anything, here is how to tell in under a minute whether a recall message is real.

Why you are suddenly getting these

The AARP Fraud Watch Network Helpline reported a spike in recall scams, with messages that claim a product you purchased has been recalled because of a safety issue and include a fake link designed to steal your personal information. AARP says these messages often impersonate trusted retailers like Amazon, Costco, and Walmart.

AARP even published the kind of wording these texts use: "To ensure your safety and process your full refund without delay, please sign in to your account through the official website and review your order below." It reads like a real company wrote it, because it was written to sound that way.

Text-based scams in general have become enormously profitable. The FTC reported that in 2024, people lost $470 million to scams that started with a text message, five times what was reported in 2020. The single most common type is a fake package delivery alert. A fake recall notice is that scam's close cousin, and it is more effective, because it adds safety fear on top of money.

How the scam works

They do not know what you bought. These texts go out to enormous lists. The message is vague on purpose, saying "your recent order" or "the item you purchased," so it fits almost anyone.

They stack two feelings at once. Fear that something in your home is dangerous, plus the pleasant idea that money is owed to you. That combination makes people move fast, and fast is the entire goal.

The link goes to a copy. It is a sign-in page built to look exactly like the real retailer. Whatever you type there goes straight to the scammer: your email, your password, sometimes a card number for the "refund."

Then the damage starts. They may log into your real account and order things with the card you have saved there. They may try that same password on your email and your bank, since many people reuse passwords. Some versions go further and call you a few days later pretending to be support, or ask you to install remote access software so they can "process the refund."

How a real recall actually behaves

This is the part worth remembering, because it works for every recall message you will ever get.

Real recalls are public. Genuine recalls are posted by the government: consumer products at cpsc.gov/Recalls, food and medicine at fda.gov/safety/recalls, and vehicles and car seats at nhtsa.gov/recalls. If the recall is real, you can find it on the right one of those sites or on the company's own website, without using anyone's link.

Real recalls tell you to stop using the product. AARP points out that legitimate recalls typically advise you to stop using the item, rather than demanding immediate action from you. A real recall notice is calm. It explains the hazard and the remedy.

Real remedies come through the company's own site. A repair, a replacement, or a refund claim form lives on the company's real website or app, not behind a link in a text message.

A retailer you have an account with will show it in your account. If Amazon really recalled something you bought, you will usually be able to find it in your account, under your orders or the retailer's own recall page.

And no real recall ever needs your password, your full card number, or a fee. Not once, not ever.

Red flags to watch for

  • The message combines urgency with a refund. Real recalls are not in a hurry to give you money.
  • The only way to act is the link they sent.
  • It does not use your name, or it says "Dear customer."
  • The product is not actually named, just "your recent order."
  • The sender is a random mobile number, an odd email address, or a web address with extra words tacked on around the brand name.
  • It asks you to sign in, confirm a password, or enter a card number to receive your refund.
  • It sets a deadline: within 24 hours, final notice, your refund expires.
  • You did not order anything from that company at all.

What to do right now

Do not tap the link. Not to look, not to check. Looking is how many of these start.

Then:

Go to the company yourself. Open their app, or type their address into your browser by hand, and look at your orders. If there is a genuine recall on something you bought, you will usually see it there.

Search the recall. Go to cpsc.gov/Recalls and search the product, or fda.gov/safety/recalls if it is food or medicine, or nhtsa.gov/recalls if it is a vehicle or a car seat. If the recall is not listed anywhere and is not on the company's own site, the message is almost certainly fake.

If you want to be certain, call the company using a number from your account, your receipt, or the company's official website that you typed in yourself. Never a number from the text.

Forward the text to 7726, which spells SPAM. The FTC recommends this, and it helps your phone carrier block similar messages for other people.

Report it at ReportFraud.ftc.gov, then delete the message and block the sender.

If someone calls you about it, you do not need to be polite about ending it. Say exactly this:

"I don't handle account or refund issues on calls I didn't start. I'll sign in myself. Goodbye."

Then hang up without waiting for a reply.

If you already tapped the link

You are not alone and you are not careless. These pages are professional copies, and the message was built to be tapped.

  • If you typed your password: change it immediately, from a different device if you can. Then change it anywhere else you used that same password, especially your email and anything financial. Turn on two-step verification on your email and shopping accounts.
  • If you entered a card number: call your bank or card company using the number on the back of the card. Ask them to cancel that card and send a new one, and to watch for charges.
  • If you signed in and now see orders you did not place: cancel what you can, then contact the retailer's real support through their app or website. Check that the email address, phone number, and shipping addresses on your account have not been changed.
  • If you installed anything or let someone control your screen: disconnect the device from the internet and have someone you trust, or a real repair shop, look at it before you use it for banking again.
  • Watch for the follow-up. People who fall for one of these often get contacted again by someone offering to fix it or recover money for a fee. That is the same crew, or one that bought your details.
  • Tell someone in your family today. Not because you did anything wrong, but because it makes the next message easier to catch.

If a message like this is on your phone right now and you are not sure about it, you can paste the text or email into Shieldle and get an AI read on it in a few seconds, before you tap a single link. It will not make the decision for you, but it gives you a fast second opinion at the exact moment you need one.