I got a weird find my link through apple sms

Update: as you are using an android device, and therefore getting the messages delivered via SMS instead of iMessage, this highly increases the risk and chances of a case involving message injection, more so SMS spoofing. Follow conversation with your contact in question, yet don’t mention the malicious link, as chances are 1. He is not involved or 2. As he notices that you’ve come after the scheme, he’ll break communication. Try him to get the phone online and be sure to activate lost mode/activation lock as mentioned above. Consider deleting all data if things go south. Contact law enforcement if necessary. If you can get him to return the phone after all, awesome. Great work and awareness there with the password change. Be sure to activate 2FA for extra security!

edit: turned off find my? If it appears, even as offline, it indicates find my has been enabled, luckily

I’d like to confirm or deny the link you received is legit, but I do not know it. Phones can go online and offline again. How have you been contacted by the supposed finder of the phone? Can you tell him to let the phone connect again? To be safe, you could consider turning on activation lock if he wouldn’t answer in the future, it will trigger as soon as your phone comes online the next time. If the link is different from iCloud.com/find, there can be other links that forward to iCloud.com. I am currently investigating any possibility for malicious contacts pretending to be apple this way.

nobody except apple will be able to send a message in a conversation which is usually used by apple. To access find my on the web, visit iCloud.com/find.