A text message can try to draw you in without containing a link, a payment demand or even a complete sentence. In a report published on October 13, Malwarebytes researcher Pieter Arntz described an unsolicited SMS received that week: the recipient’s name, followed by a question mark. Its immediate invitation was to answer.
The example is small, but the trust decision is familiar. A correct name can make an unknown number feel like a misplaced contact. It does not establish who is sending the message. If it might be someone you know, check through a number or conversation you already trust before supplying the missing introduction yourself.
The message leaves you to do the explaining
The report shows no link to inspect and no account warning to disprove. The sender offers a personal detail while withholding their own identity. A reply such as “Who’s this?” resolves that uncertainty for the recipient only if the stranger chooses to answer honestly. For the sender, it already establishes that someone is willing to talk.
Malwarebytes says the recipient’s name in the published screenshot was replaced to protect their privacy. The screenshot illustrates the opening message, not a completed fraud investigation. The report does not identify the sender, show a later investment pitch or document a financial loss from this exchange.
Name-and-number combinations can come from exposed personal data, the researcher explains. That is a plausible source of personalization, rather than proof of which database supplied this particular greeting. A familiar detail should be treated as information the sender possesses, not evidence of a relationship.
A reply gives the stranger a second move
The wider pattern predates this example. In a June 2024 consumer alert, the US Federal Trade Commission warned that apparently harmless greetings from strangers can open a conversation that develops into friendship and then a fraudulent cryptocurrency offer. Even a brief reply can confirm a working number and lead to more scam contacts, the agency says.
That distinction matters here: the October message shows the invitation to engage; the FTC describes one documented way such engagement can be exploited. We cannot attach that whole sequence to this unidentified sender. There is also no evidence in the example that replying alone installed malware, exposed a password or transferred money.
The weakness the greeting tests is social. The recipient is asked to mistake recognition of their name for verification of the other person. There is no need to discover the stranger’s intended final scam before refusing that first exchange.
If you already answered
- You only replied: stop the conversation. Report the message as spam or junk in your messaging app, then block the sender. A reply warrants caution about further contact; it does not by itself demonstrate a compromised phone.
- You think it is an acquaintance: use their saved number or an established account to ask independently. Avoid giving the unknown sender your friend’s name as a suggested identity.
- You shared a password, verification code or payment: act on what was actually shared. Contact the relevant service or bank through its official app or known contact details, preserve the conversation and transaction records, and report the fraud. Blocking the number alone does not address an exposed account or transferred funds.
Our spam-text guide covers broader SMS recognition and reporting. For a separate, documented money-loss case, the Prague cryptocurrency-fraud investigation shows why a convincing investment relationship deserves scrutiny before a transfer.
The useful signal in this new example is what is missing: an identity for the sender. Your name answers who they want to reach. It does not answer whether you should trust them.
References
- Pieter Arntz. Scammers know your name, and they’re counting on you to reply. Malwarebytes, October 13, 2026.
- Gema de las Heras. Why it’s not rude to ignore “hi, how are you?” text messages from strangers. Federal Trade Commission, June 3, 2024.
