Fake bank alert texts: how to tell a real warning from a phishing scam

Few messages trigger panic faster than “Your account has been locked” or “We detected a suspicious sign-in”. That is exactly why scammers use them.

What a fake bank alert looks like

• It claims fraud, a locked account or an unusual payment.
• It gives a link and asks you to “verify” or “secure” your account.
• The page that opens looks like your bank, with logo and colours copied.
• It asks for your username, password and a one-time code.

The one-time code is the real prize. If you type it into a fake page, the scammer can enter it on the real site in the same minute.

How to tell if it is real

Your bank can contact you, but it does not usually ask you to log in through a link in a text. Use this rule: never use the link in the message. Instead:

1. Open your bank’s official app, or type the website address yourself.
2. Check for alerts inside your account.
3. If you are worried, call the phone number printed on the back of your card.

Other warning signs

• A sender you do not recognise, or a message that arrives in an existing thread with real bank messages (scammers can spoof sender names).
• Spelling and formatting that look slightly off.
• A link whose domain is not your bank’s real domain, even if it contains the bank’s name.
• Pressure to act within minutes.
• A request to move money to a “safe account”. Banks never ask this.

If you entered details on a fake page

1. Call your bank immediately using the number on your card.
2. Change your online banking password, and any other account that shares it.
3. Ask the bank to review recent activity and block any pending transfers.
4. Report the message. In the US you can forward it to 7726 and report it at reportfraud.ftc.gov.

Check the link first

If you are not sure, paste the link into LinkGuard before you open it. A look-alike domain or a brand-new site is exactly the kind of thing the checks are built to flag.