Got an unexpected text from your bank about suspicious activity? Learn how to spot a fake bank fraud alert, verify it safely, and protect your account in the US.
Your phone buzzes with a message claiming your debit card was just used for a purchase you don't recognize, or that unusual activity was detected on your account and it will be locked unless you confirm your identity right now. There's a link or a phone number at the bottom, and the sender looks like your bank.
It's one of the most stressful messages you can get, which is exactly why scammers send it. A fake bank fraud alert is built to make you act before you have time to think. But here's the part that's easy to forget in the moment: real banks do send genuine fraud alerts by text. An unexpected message from your bank can be legitimate or it can be a scam, and you usually can't tell which just by looking at it.
So is the alert real or fake? You can't know from the message alone. The safest move is to verify it through a channel you already trust, such as your bank's official mobile app, the phone number on your card, or the website you reach by typing the address yourself, before you tap any link, call any number in the text, or share any information. This guide explains how to tell whether a bank fraud alert is genuine, how to verify it safely, and what to do if you've already interacted with it. For a broader checklist of text-message warning signs, see our guide on how to tell if a text message is a scam, and for the wider pattern these attacks belong to, read our guide on what phishing is and how phishing scams work.
A message that appears to come from your bank carries an authority that few other texts can match. It touches your money, your sense of security, and your fear of loss all at once, and scammers exploit exactly that. The Federal Trade Commission warns that impersonation messages, including texts that pretend to be from a bank, remain among the most reported types of fraud. Bank-branded messages are a consistent favorite because nearly every adult has a bank account.
A fake bank fraud alert is usually built to do one of a few things. It may try to steal your online banking username and password through a link to a convincing copy of your bank's login page, so that when you sign in the attacker captures your credentials. It may collect a one-time verification code by asking for the code your bank just sent you, which lets the attacker authorize a transaction or log in as you. It may obtain card details such as your full card number, expiration date, CVV, or billing address. It may talk you into approving a payment, adding a new payee, or confirming a transfer you didn't initiate. It may direct you to a lookalike website that mimics your bank's real site and harvests everything you enter, or persuade you to call a "fraud department" number that connects you to a scammer posing as a bank employee. In the most damaging variant, a fake agent convinces you to transfer your balance to a "safe account" that actually belongs to the attacker.
What makes these messages effective is the fear of losing money or having an account locked. When a text threatens immediate account closure or a blocked card, the natural impulse is to resolve it as fast as possible, and that impulse is exactly what the scam relies on. Slowing down long enough to verify through a trusted channel is the single most effective defense.
You don't need technical knowledge to evaluate a bank fraud alert. The warning signs below are common in fake bank fraud texts, but no single sign proves a message is fraudulent. Treat them as reasons to slow down and verify, not as a verdict on their own.
A link that leads to an unfamiliar or misspelled domain is one of the clearest signs. A genuine alert from a US bank points to the bank's own domain. A link to something like chase-alert-verify.com, bank-of-america-secure.net, or wellsfargo-login.support is a lookalike. On most phones you can long-press a link to preview where it really goes before tapping.
Requests for passwords, PINs, full card details, or one-time verification codes are another strong signal. No legitimate bank asks for these by text. A request for your online banking password, debit card PIN, full card number, CVV, or a one-time passcode is one of the strongest warning signs there is.
Instructions to move money to a supposedly safe account are always a scam. No real bank will ever ask you to transfer your balance to a different account to protect it, and the "safe account" belongs to the attacker.
Pressure to act immediately or face account closure is designed to stop you from verifying. A message that says respond within two hours or your account will be locked is a red flag. Real banks don't close accounts on a two-hour countdown triggered by a text.
Requests to install an app or allow remote access to your device are trying to take over your device. A message that asks you to install software, grant screen-sharing access, or allow remote control is a serious warning. No bank fraud alert requires this.
Unexpected requests to approve transactions or authorize account access are also a reason to stop. Being asked to confirm a transfer, approve a login, or authorize a new device you didn't initiate means you should check your account independently.
A phone number in the message you're encouraged to call is trying to move you onto a channel a scammer controls. If you need to call your bank, use the number on the back of your card.
Finally, watch for unusual wording or inconsistencies with your bank's usual communication. Generic phrasing like "your account" rather than the bank's name, odd capitalization, or a tone that differs from the alerts you've received before can all be tells.
A couple of things are worth emphasizing. Grammar mistakes are not required for a scam. Modern fake bank texts are often well-written and may be polished with AI, so a professional-looking message can still be fraudulent. And a sender name or displayed phone number is not conclusive proof of identity. Sender information can be misleading or spoofed, so a message can appear to come from your bank's name and still be sent by a scammer. Your phone may even thread a spoofed message into the same conversation as your genuine bank alerts, so a familiar thread isn't proof either.
The reliable way to check a bank fraud alert is to verify it through a channel you already trust, completely independent of the message. Don't use the link or phone number in the text to verify the text.
Start by not clicking the link or calling the number in the unexpected message. Everything in the message, from the link to the phone number to the reply instructions, exists to move you onto a channel the attacker controls.
Open your bank's official mobile app the way you normally do, or type the bank's known website address into your browser yourself. Don't follow a link from the text or from a search result you reached through the text.
Once you're in, check your account activity and any security notifications. Look at your recent transactions, alerts, and secure in-app messages. A genuine fraud alert usually appears inside the app as well.
If you'd rather speak to someone, call the number printed on the back of your bank card or the number published on your bank's official website, never a number supplied in an unsolicited text. Ask the bank whether it sent the alert and whether the transaction or account activity is genuine. A real fraud team can confirm whether there's a problem and what, if anything, you need to do.
If the bank confirms a suspicious transaction, follow its official fraud-reporting and account-security procedures. Let the bank guide the next steps, whether that's disputing a charge, replacing a card, or securing your account. And never share passwords, PINs, or one-time authentication codes in response to an unsolicited text. No legitimate bank needs these from you by text or phone to verify your identity.
A legitimate fraud alert may refer to a real transaction, so independently checking your account is more reliable than guessing from the wording of the text. If your bank's app shows no alert and no unfamiliar activity, the text didn't come from your bank.
Scammers often include a transaction amount, a merchant name, or familiar financial terminology to make a message appear credible. A charge of $487.62 at a store you recognize, or a reference to a Zelle transfer, can make the alert feel specific and real. But a message that mentions a real transaction isn't automatically authentic.
Information about recent transactions can come from a data breach, a phishing attack on someone else, or simple guesswork based on common spending patterns. The fact that a detail in the text matches something real doesn't prove your bank sent the message. The Consumer Financial Protection Bureau advises consumers to monitor their accounts regularly and to contact their financial institution directly through verified channels when something looks wrong.
Whether the text mentions a transaction you recognize or one you don't, the response is the same: open your bank's official app or contact the bank independently and check there. Don't use the message's link or phone number to verify the transaction. Real fraud alerts and fraudulent messages can look similar, so independent verification matters regardless of how convincing the details seem.
Some fake bank fraud alerts don't include a link. Instead, they ask you to call a "fraud department" or "security team" number. This is deliberate. A phone call lets a scammer build trust, sound professional, and talk you through handing over information or moving money in a way a static text can't.
If you call the number in the text and the conversation starts asking for your online banking password, a one-time code, your full card number, or permission to install remote-access software, treat it as a scam. A real bank fraud team won't ask you to read back a one-time passcode, install an app so they can access your device, or transfer money to a "safe account."
If you become suspicious during a call, end the interaction and contact your bank through a trusted, independently obtained number, such as the one on the back of your card or on your bank's official website. Don't share verification codes, disclose online banking credentials, install remote-access software, or transfer funds at the request of an unsolicited caller.
It's worth being clear that not every phone call about a bank transaction is fraudulent. Your bank may genuinely call you about suspicious activity. The difference is what the caller asks for. A legitimate bank employee won't object to you hanging up and calling back on the number printed on your card. If a caller resists that, or pressures you to stay on the line, that resistance is itself a warning sign.
The right response depends on what actually happened after you clicked. Clicking a link alone doesn't automatically mean your account or phone has been compromised, but it does mean you should act based on what you did next.
If the page opened but you entered no information, close it and avoid further interaction. Don't download anything, grant permissions, or allow notifications. Check your browser for unexpected downloads and clear them.
If you entered banking credentials, contact your bank through its official channel immediately and secure the account. Use the number on your card or the in-app support option. Ask the bank to review recent logins, secure the account, and reset your access if needed.
If a password was reused elsewhere, change it on other affected accounts. Start with your email account, since email is often the gateway to resetting other passwords, and use a unique password for each service.
If a verification code was shared or an unexpected login was approved, notify the bank promptly and review account security. One-time passcode relay scams move in under a minute, so speed matters. Ask the bank to check for unauthorized transactions or new payees.
If card details were entered, contact the card issuer to discuss blocking or replacing the card and monitoring transactions. Most issuers can freeze or replace a card quickly and watch for fraudulent charges.
If money was transferred or an unfamiliar transaction appears, contact the bank immediately and ask whether it can stop, reverse, or investigate the transaction. Timing matters. Some transfers can be recalled if reported quickly, but recovery is never guaranteed.
If an application was installed or device permissions were granted, follow trusted security guidance for the device and seek assistance when necessary. Uninstall anything you didn't intentionally install, revoke permissions you don't recognize, and consider a reputable security scan.
The key principle is that the right response depends on what information was shared and what actions were taken. A click with no information entered is a lower-risk situation than a transferred balance, but both deserve attention.
If you disclosed sensitive details or lost money, act quickly. Prompt action may help limit losses, but recovery isn't guaranteed, and outcomes depend on the type of transaction and the circumstances.
Contact your bank using its official phone number or app, never a number from the text. Explain exactly what was disclosed, clicked, approved, or transferred. The more specific you are, the better the bank can respond.
Ask the bank to secure the account, review transactions, and determine whether cards, credentials, or access tokens need to be replaced or revoked. This may include freezing the account, issuing a new card, or revoking active sessions.
Change compromised passwords through the official website or app. Start with your email and banking passwords, and use a unique password for each account. Review recent transactions and account alerts for transfers, new payees, or changes to your contact details that you didn't make.
Preserve the text message, sender details, links, screenshots, and transaction records. Evidence helps your bank and law enforcement investigate. Then report the suspected fraud through the appropriate official channels, covered in the next section.
Be aware of a common follow-up: recovery scams. After a person loses money, someone may contact them claiming they can recover the stolen funds in exchange for an advance fee, a "recovery" payment, or sensitive information. These are scams too. No legitimate recovery service guarantees the return of stolen money for an upfront fee. If anyone promises to get your money back for a fee, treat it as a second scam aimed at someone who's already been victimized.
Reporting helps protect you and others. In the United States, several channels accept reports of fake bank fraud texts.
You can report suspicious texts through your messaging app or mobile carrier where supported. Most major US carriers support forwarding suspicious texts to 7726, which spells SPAM on a phone keypad. Check your carrier's specific instructions, since the exact process can vary by provider and device. Apple and Google also offer built-in options to report junk or delete and report messages in their messaging apps.
Report fraud or impersonation attempts to the Federal Trade Commission. The FTC accepts reports at ReportFraud.ftc.gov, and reporting there helps law enforcement track and act on fraud patterns.
Contact your bank's official fraud department using the number on your card or in your bank's app to report the impersonation and any unauthorized activity on your account.
If financial loss or identity theft is involved, contact the appropriate authority. If you lost money, you can also report to the FBI's Internet Crime Complaint Center (IC3). If identity theft is involved, the FTC's IdentityTheft.gov walks you through a recovery plan.
Reporting instructions and short codes vary by carrier, bank, and device, so confirm the current process for your situation rather than assuming one method works everywhere. The FTC's scam alerts page is a good starting point for current guidance.
When a bank fraud alert text has you unsure, one practical step is to analyze a suspicious bank text with Scamlify's SMS Scam Checker. You paste the raw text message, including the sender number or shortcode if you have it, and the tool returns a 0 to 100 risk score, the warning signs it found, any suspicious URLs, what personal or financial information the message requests, and recommended next actions. The text is parsed in memory for a single request and never stored or logged.
The checker is tuned for smishing patterns such as manufactured urgency, lookalike and shortened links, and requests for one-time codes or payment details, which are exactly the patterns common in fake bank fraud alerts. It can help you examine a suspicious message and identify potential warning signs before you act on it.
It's important to understand what the tool can and cannot do. The SMS Scam Checker assesses the content of a message you provide. It can't access your bank account, confirm whether a transaction actually occurred, freeze or lock an account, recover money, contact your bank on your behalf, or guarantee that a message is safe. A low score means few scam markers were detected, not that the message is definitely from your bank. A high score means many markers were present, not that fraud has already happened. Use the result alongside independent verification through your bank's official app or the number on your card.
One privacy caution: never submit banking passwords, PINs, card security codes (CVV), or one-time authentication codes to an online checker. For most assessments, the message text without sensitive details is enough. If you want to examine a link from the text further, you can also run it through the URL Scam Checker for structural analysis.
You can't tell from the message alone. The strongest warning signs are a link to a lookalike domain, a request for your password, PIN, full card number, or one-time code, pressure to act right away, instructions to move money to a "safe account," or a phone number that doesn't match the one on your card. No single sign proves a text is fake, but a few of them together are a good reason to stop and check with your bank through its official app or the number on your card.
Yes. Many US banks send genuine fraud alerts and security notices by text. A real alert usually tells you something happened and points you to the bank's app or a number you already know. What matters is what the message asks for. A legitimate bank won't text you a link to verify your password, ask for your one-time passcode, or tell you to move money to a safe account.
As a rule, no. If the alert includes a link, treat it with caution. Open your bank's official app or type the bank's website address yourself, or call the number on the back of your card. On most phones you can long-press a link to preview where it goes, but don't tap it just to check. Tapping can load a fake login page or trigger tracking.
Yes. Scammers can include a transaction amount, merchant name, or familiar wording to make a message look credible, using details from data breaches or simple guesswork. A message that mentions a real transaction isn't automatically authentic. Check it through your bank's official app or by calling the number on your card, never through the link or number in the text.
Close the page and don't enter any information. If you typed a password, change it on the real banking site or app right away and turn on multifactor authentication. If you entered card details, contact your card issuer to block or replace the card. If you shared a one-time code or approved a login, tell your bank immediately, because code-relay scams move in under a minute. If you transferred money, contact the bank right away and ask whether it can be stopped or reversed. For a full recovery walkthrough, see our guide on what to do if you clicked a phishing link.
It depends on the type of transaction, the circumstances, and your bank's policies, and no outcome is guaranteed. US protections vary by payment type. Unauthorized electronic fund transfers and credit card transactions may have dispute rights under federal law, but person-to-person payment apps, wire transfers, and cryptocurrency often work like cash and are much harder to reverse. Report the fraud to your bank and to the FTC at ReportFraud.ftc.gov as soon as possible, and ask your bank about its dispute process. Faster reporting can help, but it doesn't guarantee reimbursement.
Forward the suspicious text to 7726 (it spells SPAM) on most major US carriers, report the fraud to the FTC at ReportFraud.ftc.gov, and contact your bank's fraud department using the number on your card. If you lost money, you can also file a report with the FBI's Internet Crime Complaint Center at IC3.gov, and if identity theft is involved, use IdentityTheft.gov. Carrier steps vary, so confirm the current process for your provider.
Not on its own. An SMS scam checker reads the message you provide and can flag warning signs like urgency, lookalike links, and requests for codes or payment details, returning a risk score and the specific red flags it found. It can't access your bank account, confirm whether a transaction happened, verify the sender against your bank's records, or guarantee a message is safe. Use it as one piece of evidence alongside checking through your bank's official app or the number on your card.
Know in seconds if it’s a scam.
Paste an email, text or link. Scamlify’s AI returns a risk score, the exact red flags and what to do next — while teaching you the pattern behind the attack. No account, no storage, nothing logged.
Scamlify — AI-Powered Scam & Security Intelligence Platform. Sitemap.