A new wave of fraud in 2026 reaches you where you are least guarded: your phone. Scammers are sending text messages that pose as your retirement account provider and ask you to “verify” or “roll over” your savings through a link. This guide shows you how to read one of these texts, spot the fake in under a minute, and protect the money you have spent decades building.
Why Gold IRA Scammers Moved to Your Text Messages
Email scams have been around long enough that most spam filters catch them and most savers know to be wary. Text messages are different. They land directly on your lock screen, they feel personal, and very few people run a phone number through a filter the way they would an email address.
The numbers explain the shift. The Federal Trade Commission reported that consumers lost about $470 million to scams that started with a text message in 2024, roughly five times the figure from 2020, even as the raw number of reports fell. You can see the agency’s breakdown in its 2024 text scam data release. Losses are rising because the scams are getting better, not because there are more of them. Imposter scams as a whole cost Americans a record $3.5 billion in 2025.
Retirement savers are a prime target for a simple reason: that is where the money is. Someone with an IRA or 401(k) often has six figures sitting in one account, and a single fraudulent “rollover” can be devastating. Near-retirees and retirees are hit especially hard because they tend to have larger balances and may be less familiar with how text-based fraud works.
What this means for you: if you hold a retirement account, you are on a list somewhere. Treat any unexpected text about that account as suspicious until you have proven otherwise.
Five Red Flags in a Fake Retirement Text
Fake “retirement provider” texts tend to share a recognizable pattern. Learn to spot these and you can clear most of them in seconds.
- Urgency and fear. The message warns that your account is “frozen,” “at risk,” or “requires immediate verification.” Real custodians do not threaten you by text to force a fast decision.
- A link you did not ask for. Legitimate providers rarely, if ever, text you a link to move or verify funds. Shortened or odd-looking URLs with random characters, misspelled brand names, or unusual domains are a major warning sign.
- A sender ID that does not match. Scammers spoof names and numbers. A text may show a company name while the reply number is a random mobile line.
- A request for personal or account information. No real custodian asks you to enter your Social Security number, account login, or transfer details through a texted link.
- An offer that is too good. “Move your IRA to gold today and lock in a bonus” or guaranteed-return language is something no compliant firm would put in an unsolicited text.
What this means for you: you do not need to identify which red flag applies. If even one is present, stop and verify through a separate channel.
How Legitimate Custodians Actually Contact You
Knowing how a real firm behaves makes the fakes obvious. A legitimate IRA custodian or precious metals dealer communicates through your secure online account portal and through official mailed or emailed statements. When they do reach out, they do not ask you to move money by tapping a link in a text.
If you ever receive a message claiming to be from your provider, verify it independently. Find the customer service number on your most recent official statement, or type the company’s known website address into your browser yourself. Call that number. Never call the number in the text and never use the link it provides, because both can route you straight to the scammer.
A reputable company will also never pressure you to act within minutes, never demand payment or transfers in unusual forms, and never object to you hanging up to confirm through official channels. If anyone resists you verifying, that is your answer.
What this means for you: build one simple habit. When a text mentions your retirement money, close it and reach your provider through a number or website you already trust.
What to Do If You Already Tapped the Link
Mistakes happen, and acting quickly limits the damage. If you clicked a link or entered any information, take these steps in order.
- Contact your real custodian and financial institutions immediately using verified numbers. Tell them what happened and ask them to watch for or freeze any unauthorized activity.
- Change the passwords for any account whose details you may have exposed, and turn on two-factor authentication where you can.
- If you shared your Social Security number, consider placing a fraud alert or credit freeze with the major credit bureaus.
- Report the scam to the FTC at ReportFraud.ftc.gov, which helps investigators track patterns and pursue enforcement.
Keep the original text as evidence rather than deleting it right away, and monitor your statements closely over the following months. The faster you move, the more options you have to contain the loss.
The Bottom Line
Smishing works because it is fast, personal, and dressed up to look official. The defense is slow and boring on purpose: no reputable custodian or dealer will ever cold-text you a link to move your retirement savings, so any text that does is a fake until proven otherwise. Verify through a number you already trust, never the one in the message, and you take away the only thing these scams rely on, your split-second reaction.
Key takeaway: treat every unexpected text about your retirement account as a test, and the safest answer is always to verify independently before you tap.
