Fake Bank Text Messages: How to Tell a Real Alert From a Scam

A scam text can talk about a suspicious purchase, a locked account, a profile that needs updating, or money waiting to be claimed. The subject changes from one wave to the next, but the goal is usually to get you to open a page, enter details, or install something.

This has a name: smishing, the text message version of phishing, the fake message built to take data or money. Our guide to what smishing is covers the general shape. Here the focus is the message that claims to come from your bank, which is the version that moves the most money the fastest.

Just got one? Do only this

1. In the first minutes, do not tap the link. You do not need the address in the message to check whether the alert is real.
2. Do not reply, and do not call the number the text gives you.
3. Open your bank’s app yourself, from the icon on your phone, and see whether the alert exists inside your account.
4. If you need to speak to someone, use the number on the back of your card or inside the app.
5. Report the text. Forward it to 7726, which spells SPAM on a keypad, then file it at ReportFraud.ftc.gov.

If there is a real problem with your account, the official channel will show it without the link. Never use a phone number, a button, or an address supplied by the message you are trying to check.

What a real bank text does and does not ask for

Banks differ in what they send, so your own bank’s security page is the place to confirm the details. What does hold across them is the shape of the request. A real alert tells you something and points you back to the app. A scam message needs an action from you, inside the message, right now.

The last row is the one worth memorizing. The Federal Trade Commission’s guidance on business impersonators is direct about it: nobody legitimate will tell you to move your money to protect it, and a request to transfer funds to a “safe” or “secure” account is the scam itself, not a step in fixing one.

The same goes for the six-digit code your bank texts you when you sign in. That code is the lock. Anyone asking you to read it out, forward it, or type it into a page they sent is asking for the key, whatever reason they give.

The stories used most often

The pretexts repeat because they work on everyone at least once. The Federal Communications Commission’s guidance on smishing describes the pattern: a text from a number you do not know, a problem or a prize, and a link or a number to use immediately.

In the bank version, the story is almost always one of these: a charge you do not recognize, a sign-in from a new device, an account about to be locked, a transfer put on hold, or a refund waiting to be released. A newer variation skips the link and asks you to reply “yes” or “no” to a purchase, then a person calls a minute later, sounding like fraud prevention, and walks you through handing over a code.

Money waiting to be claimed is also used as bait. If a message says you have a payment, a benefit, or a refund coming, go to the agency or the company directly and look for it there. What repeats across all these stories is not the subject. It is the ask: tap this, tell me the code, install this, send the money.

The sender line proves nothing

The name or the number shown as the sender does not establish who sent the message. Short codes can be imitated, numbers can be spoofed, and a scam text can land in the same thread as the real alerts you have been getting for years, because phones group messages by the sender label they are given.

A number that looks local, a name spelled correctly, and a message with no typos do not confirm anything either. Those details are cheap to produce. The confirmation has to come from a channel you opened yourself: the app, the official site typed by you, or the number printed on your card.

Look at the request, not the alert

The alarming part grabs your attention, but the risk lives in the action offered as the solution. Read past the warning and look at what you are being asked to do:

• Account locked or under review: the message wants you to open a link to unlock it.
• Suspicious purchase approved: the button says to tap if it was not you.
• Details out of date: the text asks you to update them at an address it supplies.
• Money available: the link promises to release the payment.
• Security key expiring: the contact asks for the code that just arrived on your phone.

The subject can change; the requested actions barely do. Open a link, give a code, install an app, or move money. That action is what has to be checked outside the message.

How the message is usually written

The message below was written by us, from scratch, to show the format. It is nobody’s screenshot, and the bank’s name is left out on purpose: in a real one it would be written right there, and that name is what makes people believe it.

Three things make that message work, and they still work on someone who is paying close attention, because the message imitates what the bank really does:

• A short deadline, which leaves little room to open the app and look.
• An easy way out, one tap, placed exactly where the real fix would take longer.
• A shortened address, which hides where the link actually goes.

Do not use the link or the number in the message

The link opens a page built to look like your bank, and the number reaches a person playing the part of the fraud department. Use neither, even when the wording sounds right and even when you were expecting a message from your bank. Leave the text, open the app from your home screen or type the address you already know, and if you need a phone number, take it from the app or the back of your card.

If you did open a page, do not treat the padlock as the answer. HTTPS protects the connection, but the address can still belong to someone else, and in Chrome the padlock is gone: since version 117, released in 2023, the bar shows a settings icon instead. The Chromium blog explains that nearly every phishing site uses HTTPS too. Read the full domain and compare it with your bank’s real address before entering anything. Our guide to how to check if a link is safe shows which part of an address identifies the owner of a site.

If you cannot confirm it right then, leave it for later. A real problem will still be there in the official channel, and it will not require the route the message handed you.

Requests that mean stopping the conversation

Stop if the message, or the call that follows it, asks for any of these. Then go find the bank through the app, the site, or the number you looked up yourself:

• A password, of any kind, whole or in pieces.
• The verification code that just arrived on your phone.
• That you install an app sent by link to “fix the problem”.
• That you move money to an account described as safe, temporary, or held in your name. Do not send anything before confirming the request in the official channel.
• That you allow remote access to your phone or computer.

Do not stay in the same conversation to ask whether the request is genuine. The channel you were handed is part of what needs checking.

How to judge any other suspicious text

The same messages arrive in the name of stores, delivery companies, toll authorities, and digital services, often as a small fee on a package that is supposedly held. The company named changes; the check does not. Our guide to package delivery scams covers the delivery version in detail.

When an unexpected message brings urgency or asks for something, work through this:

1. Separate the alert from the action. An alarming line creates hurry. Look at whether the fix requires a link, a reply, a call, a code, an install, or a payment.
2. Check the story in a channel you found yourself, never the one that came inside the message.
3. Notice what would leave your control. Do not send money, codes, or details, and do not install anything, before the request is confirmed.
4. Check the deadline in the official channel. A short deadline is often there to stop you from checking. The clock in the message is not evidence that you have to act through it.

If you already clicked

Clicking happens, including to people who are paying attention. What comes next depends on what you did after. The FTC’s page on what to do if you were scammed sorts the responses the same way, by what the scammer actually got.

1. In the first hour, call your bank if you gave out account details, a card number, or a code. Use the number on the back of your card. Say the word fraud, ask them to stop any pending payment, flag the account, and reissue the card. Card and account protections depend on how quickly you report, as the FTC’s comparison of card protections explains, so this is the call that cannot wait.
2. If the page is still open: close it without filling in fields, downloading files, or accepting permissions.
3. If you typed a password: change it on the real site, from a device you trust, and change it anywhere you reused it. Turn on two-factor authentication while you are there.
4. If you installed something: stop using that device for banking, disconnect it, and contact the affected services from a different device.
5. If you already sent an instant payment, by Zelle, by wire, or through a payment app, tell the bank immediately and say it was fraud. Those transfers are hard to reverse and the chance depends on speed. The steps are in our guide to what to do after an instant payment scam.
6. Keep everything. The message, the link address, the time, and any receipts.

Fake bank text FAQ

Sources

The guidance above was checked on September 22, 2026 on these pages:

• Federal Trade Commission: business impersonators
• Federal Trade Commission: how to recognize and avoid phishing scams
• Federal Trade Commission: what to do if you were scammed
• Federal Trade Commission: lost or stolen credit, ATM, and debit cards
• Federal Communications Commission: avoid the temptation of smishing scams
• Federal Communications Commission: stop unwanted robocalls and texts, including forwarding to 7726
• Cybersecurity and Infrastructure Security Agency: recognize and report phishing
• Chromium blog: the padlock replaced by a settings icon