One thing worth adding because it catches careful people: do not reply to the message at all, even to say no.
A response confirms the account is live and that somebody reads their messages, which is worth something to whoever sent it. These are usually sent in bulk, and the ones that answer get worked on properly: a phone call, a more convincing story, urgency.
Block and report the message, then deal with the money through the bank only. Every conversation about it should be with people you contacted using a number you already had.