Oof, severed head scams are so ubiquitous that I can't even blame the girl for this one; this sorta shit's just gonna keep happening as long as you're still using ancient messaging standards like SMS. RCS has supported end-to-end encryption to prevent ghost-in-the-middle attacks for more than a decade at this point, but god fucking forbid the telecoms upgrade their security infrastructure to prevent unwarranted ectoplasmic intrusion.