Unsolicited PropelLend ‘Loan Ready’ Texts Hit Short Code 64152 — Even When You Never Applied

On Sunday, November 1, 2026, an EmailMeNow field sample arrived by SMS from short code 64152 (T-Mobile delivery). The body followed a pattern now widely reported online: a PropelLend prefix, a first name that was not the recipient’s, a small “loan amount” (820 in our sample), urgency to verify now, a propellend.com link with a random tracking path, and Reply STOP to opt-out.

The recipient never applied for a PropelLend loan. That mismatch — wrong name, never applied, tiny amount — lines up with the FTC’s January 2026 fake loan text scam alert: unexpected texts about loans you did not request, pressure to reply or click, and follow-on asks for SSN or bank details that fuel identity theft and account takeover.

PropelLend and LendHorizon LLC appear to be real businesses operating an online installment-loan site. This article does not label the company a scam. It does treat this unsolicited text as dangerous smishing until you verify any lender through channels you open — and it notes we cannot tell from one message whether PropelLend, a lead generator, or an unrelated actor sent it.

For Texas small businesses, the angle is familiar: employee phones are part of your attack surface. One tap on a fake “verify loan” page can harvest credentials that later hit payroll, email, or client data. Train staff to forward junk to 7726, use carrier spam tools (T-Mobile Scam Shield and peers), keep phishing-resistant MFA on bank and email, and publish DMARC on your domain so your firm’s name is harder to spoof in follow-up mail.

Snapshot

What the text says

Paraphrasing the Nov 1 sample (no recipient name, no tracking URL):

Propellend: [first name] Your loan amount: 820 is ready to proceed Please verify now: https://propellend.com/<random-code> Reply STOP to opt-out

We are not reproducing the random path. Do not visit propellend.com links from SMS — type propellend.com yourself only if you chose to research the lender, and never submit an application because a text told you to.

Who is behind propellend.com (what’s known and unknown)

Known from public pages only (homepage, Rates, Privacy Policy, Terms of Use, Support):

• propellend.com markets online installment loans with fixed monthly payments. Footer text names LENDHORIZON LLC DBA PropelLend.com, 7533 S Center View Ct Ste N, West Jordan, UT 84084, phone 888-340-1191.
• Depending on state and income, the site says borrowers may qualify for $5,000 to $50,000 — far above the 820 figure in the text.
• lendhorizon.net describes LendHorizon LLC as a licensed consumer finance company and PropelLend as its online lending platform. The site lists NMLS # 2737592 with a link to NMLS Consumer Access. It says lending occurs in select U.S. jurisdictions where permitted by law but does not replace a regulator lookup.
• RDAP (Verisign, Nov 1, 2026): propellend.com registered 2025-06-25, last changed 2026-07-27, registrar Namecheap, Inc. The site is served behind Cloudflare (audit/blacklist probes saw Cloudflare CDN IPs).

Unknown from one SMS:

• Whether LendHorizon / PropelLend sent this message, a marketing partner did, or a third party borrowed the brand.
• Whether short code 64152 is registered to PropelLend. Support documents Reply STOP / HELP for SMS and says applications may trigger email and SMS updates — but we did not find a public page listing 64152 as of Nov 1, 2026. Reddit threads tie 64152 to this loan amount + propellend.com link pattern back to March 2026.

Regulatory homework: Confirm licenses at NMLS Consumer Access (company 2737592). We did not find a clear CFPB or BBB complaint profile for LendHorizon LLC in quick public searches on Nov 1, 2026 — absence of hits is not proof of a clean record.

Red flags

These match the FTC alert and the field sample — whether or not the brand is real:

1. You never applied for a loan, but the text says an amount is “ready.”
2. Wrong first name — classic sign of list spraying, not a personal underwriting notice.
3. Absurdly small “loan amount” (820) vs the site’s public $5,000–$50,000 range.
4. Verify now + link — smishers want clicks that lead to fake portals, SSN forms, or bank login pages.
5. STOP in the same message — replying can confirm a live number even when you are angry; the FTC says don’t reply to suspicious loan texts.

TCPA / consent context: Marketing SMS generally requires prior express written consent under U.S. telemarketing rules; the CTIA Short Code Monitoring Handbook expects registrants to honor opt-out and consent standards. An unsolicited loan text to someone who never opted in is a compliance red flag regardless of who owns the short code — and it is still a security red flag for the recipient.

What to do

1. Do not tap the link. Do not reply STOP, YES, or callback numbers from this thread if you did not initiate contact — use carrier report junk instead.
2. Forward the text to 7726 (SPAM). Report at ReportFraud.ftc.gov and IC3 if you want a federal record.
3. If you already clicked or typed SSN / bank data, start at IdentityTheft.gov — freezes, fraud alerts, and an recovery plan.
4. Employers: Add mobile smishing to security awareness — same urgency as email phishing. Encourage 7726 reporting and document T-Mobile Scam Shield / carrier filters for company-owned lines.
5. Verify any real lender only via NMLS Consumer Access, your state regulator, and a URL you type — not a text link.
6. Business domains: Keep DMARC at reject (where you can) so criminals cannot easily send “your firm verified the loan” follow-ups from lookalike mailboxes.

MFA: YubiKey and Google Authenticator

Loan-text lures often end on fake login or “upload ID” pages. Phishing-resistant MFA on email, Microsoft 365, and banking cuts a lot of follow-on account takeover — it does not unsend an SSN typed into a scam form. Grades match our MFA directory.

Enroll credit-bureau portal MFA before you need a rush credit freeze after identity theft. Directory: MFA support directory.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited propellend.com and lendhorizon.net on November 1, 2026. 100% is the ideal — neither reaches it. Scores reflect public email, transport, and website posture. They do not prove who sent short code 64152, and they are not a loan-underwriting safety grade.

Audit links: propellend.com · lendhorizon.net

Weak Transport (15%) on both domains is a reminder that authenticated email from a lender brand is not something these scores guarantee — treat unexpected texts as unverified even when the domain exists.

Website stack note

Deep website-tech probe (node scripts/probe-website-tech.mjs --deep --fresh) was not run for this article — WEBSITE_TECH_PROBE_KEY was unavailable in the authoring environment. Passive homepage review only: bundled CSS/JS, Google Analytics tag, Cloudflare front door; no CMS name in public HTML alone.

Blacklist and lookalike domains

Email blacklist checks (public DoH, November 1, 2026): propellend.com and lendhorizon.net were clear (0 mail/domain hits on checked lists). A propellend.com web/CDN SPFBL note is informational noise — not proof of SMS abuse.

Cybersquat scan (propellend.com, BEC profile, registered signals only):

High-interest registered names (investigate; not proof this SMS used them):

Type propellend.com yourself if you choose to visit the brand. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• Fake Chase card-hold SMS
• $300K smishing scheme recap
• RatHat Android smishing
• MFA support directory

Check your domain free at audit.emailmenow.com, or see automated reports and monitoring.

Sources: EmailMeNow field SMS sample (Nov 1, 2026) · FTC fake loan text scam alert (Jan 2026) · Reddit r/isthisascam (Mar 29, 2026) · propellend.com · propellend.com Support · propellend.com Privacy Policy · lendhorizon.net · NMLS Consumer Access — company 2737592 · Verisign RDAP for propellend.com (Nov 1, 2026) · CTIA short-code program materials · Independent EmailMeNow audits, blacklist, and cybersquat probes November 1, 2026. Domain scores: audit.emailmenow.com only.