Do not use the link or phone number in the message. Open your bank’s app yourself, or call the number on the back of your card to check what is happening.
If you already shared a password, verification code, or payment, contact the bank’s fraud team immediately through that independent channel.
An unexpected fraud alert can catch you at exactly the wrong moment: you are making dinner, leaving work, or trying to get the children out the door. The message says a purchase was declined or your account needs attention. Acting quickly feels responsible.
That is what makes a bank text scam effective. It borrows a sensible concern—protecting your money—and tries to turn it into a rushed decision.
You do not need to decide whether the message looks convincing. You need a safer way to check it.
Leave the message and check with the bank
Do not reply, follow its link, or call its callback number while you are unsure. Instead:
Open the banking app you already use. Check recent activity and any available account messages.
If you see an unfamiliar transaction or still have concerns, call the bank. Use the number printed on your card, shown in your established banking app, or listed on your statement.
Describe the alert and ask whether the bank sent it. If there is a real account problem, handle it through the channel you opened independently.
An empty notification screen does not settle every question. A transaction may be pending, or your bank may deliver alerts differently. When the situation is unclear, speak to the bank.
Avoid searching for a customer-service number and calling the first result. The American Bankers Association warns that scammers create fake customer-service sites and recommends using your card or statement instead.
Here is a simple way to start the conversation:
“I received a text claiming to be a fraud alert. I’m calling the number on my card to verify it. Did you send the message, and is there anything on my account that needs attention?”
If someone calls while you are checking, you can end that call and contact the bank yourself. You do not have to continue an incoming conversation to resolve a genuine problem.
A believable message is not proof
A fake bank text message might claim that an account is locked, a payment failed, or a suspicious purchase needs confirmation. These are common phishing stories described in the FTC’s phishing guidance.
Text-message phishing is often called smishing. The term describes the delivery method; the practical problem is that someone wants you to reveal information, open a harmful link, or follow fraudulent instructions.
Watch what the message asks you to do:
Enter your banking password through its link.
Send back a login or transaction code.
Call a number supplied in the message.
Install software so someone can “secure” your device.
Transfer funds to a supposedly protected account.
Poor spelling can be a clue, but polished writing does not establish authenticity. Neither does a bank name or convincing formatting.
Some legitimate banks do send fraud alerts and may offer a reply-based confirmation process. That does not mean every unexpected “Was this you?” text is genuine. Until you have independently verified the message or the bank’s established procedure, use the app or a trusted phone number.
Two requests that should stop the conversation
“Read me the code we just sent”
A verification code can authorize access or an action on your account. Do not give a login or payment code to someone who unexpectedly calls or texts claiming to be the bank.
The FTC explains how impersonators use these codes to gain account access.
Entering a code into the official banking app during a login you started is different from telling it to an unsolicited caller. Read the code message carefully, including what it says the code will authorize.
If you did not initiate the action, do not approve it.
“Move your money to keep it safe”
Stop if someone tells you to transfer money to a “safe account,” send it to yourself using their instructions, or move it to reverse fraud.
The FTC warns that moving money to “protect it” is an impersonation scam.
End the conversation and contact your actual bank. Do not make a small “test transfer” to see whether the instructions work.
If you already responded, start with what you actually did
The right response depends on what you shared or allowed. Receiving a suspicious message is different from submitting a password or authorizing a payment.
What happened | What to do next |
|---|---|
You only received or read the text | Verify independently if concerned; report and block it once identified as a scam |
You replied but shared no sensitive information | Stop engaging and watch for follow-up contact |
You opened the link but entered nothing | Close it; check whether you downloaded anything or granted permissions |
You entered a password or card details | Contact the bank immediately and secure the affected credentials |
You shared a code or approved a prompt | Tell the bank exactly what you authorized; treat it as urgent |
You sent money | Contact the bank or payment provider immediately and request recovery assistance |
You clicked the link but did not submit anything
Clicking alone does not establish that someone has accessed your bank account. However, it should not be treated as proof that nothing happened.
Close the page. Do not return to inspect it or finish the form. Note whether you downloaded a file, installed an app, or approved any request.
If harmful software may have downloaded, the FTC recommends updating security software and running a scan. Mobile-device checks depend on the operating system; use the manufacturer’s support guidance rather than a cleanup tool advertised by the suspicious page.
If you installed remote-access software or allowed someone to control the device, stop using it for banking. Contact the bank from another trusted device and seek help from a support provider you know.
You shared a password, code, or financial details
Call the bank immediately. Say what you supplied and whether you approved a login, transaction, or other prompt.
From a trusted device, change an exposed password through the official service. Change it elsewhere if you reused it. Ask the bank to review account access and tell you what additional protective steps are appropriate.
If personal information was exposed, use the FTC’s IdentityTheft.gov resources for recovery guidance.
These steps follow the FTC’s advice for people who gave information to a scammer.
You transferred money
Contact the bank or payment provider immediately. Explain that an impersonator tricked you, identify the payment, and ask whether it can be stopped, reversed, or recovered.
The FTC recommends reporting the payment and requesting a refund. Recovery is not guaranteed.
Describe events accurately, including whether you made the transfer yourself under fraudulent instructions. Do not let embarrassment delay the call.
Save the details, then report the message
If money or account access may be at risk, contact the bank first. Collecting evidence should not postpone that conversation.
Preserve the message and relevant details: the sender, time, callback number, any payment reference, and what you shared. You can take screenshots without reopening the link. Keep sensitive screenshots private.
For U.S. readers, the FTC lists three reporting options:
Forward the text to 7726, which spells SPAM, following your carrier’s process.
Use your messaging app’s report-junk or report-spam feature.
Report the attempt at ReportFraud.ftc.gov.
After preserving any needed evidence, block the sender and delete the message. Reporting a text does not replace contacting your bank about exposed information or lost money.
Give your household one rule to remember
You do not need everyone to memorize every version of this scam. Agree on one habit:
When a message says there is a banking problem, leave the message and contact the bank independently.
Set up transaction alerts through your existing banking app and make sure household members know where to find a trusted contact number. If a message creates pressure or confusion, involve someone you trust before acting.
You do not need to win an argument with a scammer or prove a text is fake. A genuine account issue can be checked through your bank. Start that separate conversation, and let the message wait.
