Your phone buzzes. It’s a text from your bank. “Suspicious activity detected on your account. Tap here to verify or your card will be locked.”
Your first reaction is probably worry, then a reach for the link. That reaction is exactly what the people sending these texts are counting on.
Fake bank texts are one of the most common scams sent today, and they’re built to look almost identical to the real thing. This guide walks through exactly how to tell a fake bank text from a real one, what your bank will and won’t ever ask by text, and the one habit that protects you every time.
How can you tell if a text from your bank is fake?
You usually can’t tell just by reading it, which is why you check a different way instead of trusting the text itself. Scammers copy real bank logos, names, and writing style closely enough that looking for spelling mistakes or odd wording won’t reliably catch them anymore. The safest approach is to never use any phone number, link, or “reply” option inside the text itself. Instead, put the text aside completely and contact your bank using a number or app you already know is real.
Plain talk: smishing
“Smishing” is phishing done through a text message instead of an email. The word blends “SMS” (text messaging) and “phishing.” A smishing text pretends to be from a company you trust to get you to tap a link or hand over information.
Why this scam works so well
Bank impersonation is now the most-reported type of text scam, according to a Federal Trade Commission analysis of 2022 reports. The FTC found that reports of texts impersonating banks have increased nearly twentyfold since 2019, rising from 1,355 reports that year to 25,725 in 2022.
Text scams overall cost people $330 million in 2022, more than double what was reported in 2021. For bank impersonation texts specifically, the median amount people lost was $3,000. The banks scammers copy most often are the biggest and most familiar ones: Bank of America, Wells Fargo, Chase, and Citibank topped the FTC’s list.
There’s a simple reason these texts work better than scam emails. People read texts almost as soon as they arrive, and a message that mentions your money creates an urge to act fast, before you’ve had time to stop and think.
How scammers know your bank’s name
Most fake bank texts aren’t targeted at you personally. Scammers send the same message to enormous lists of phone numbers, often bought or generated in bulk, without knowing which bank any one person actually uses. They rely on the odds: if they name a big, common bank like Chase or Bank of America, a large share of recipients will bank there and assume the text is real.
Some scammers go further and use personal details leaked in past data breaches, such as your name, address, or part of a card number, to make a text feel personal and specific. That extra detail can feel convincing, but it says nothing about who actually sent the message. A criminal with your name and partial card number from an old breach can put both into a text just as easily as your real bank can.
Plain talk: data breach
A data breach is when a company’s customer information is stolen by hackers. Even if the breach happened years ago and had nothing to do with your bank, scammers can still reuse those old, leaked details today.
Warning signs of a fake bank text
Look for any combination of these:
- Urgency. “Your card will be locked in 24 hours” or “verify now to avoid a hold on your account.”
- A request to tap a link to “verify,” “confirm,” “restore,” or “review” your account.
- A request for information such as your online banking password, PIN, one-time passcode, or full card number.
- A generic greeting, like “Dear Customer” instead of your name, though some scam texts do use your real name.
- A sender number that looks like a regular mobile number, or one that matches a previous real text from your bank (numbers can be faked).
- A shortened or unfamiliar web address instead of your bank’s actual website.
Safety tip
Never tap a link in a text that claims to be about your bank account, even if it looks convincing. If you’re worried something might actually be wrong, close the text and check another way.
What your bank will and won’t do by text
| Real banks typically | Scam texts typically |
|---|---|
| Send account alerts without a link, or with a link only to log in through the official app | Include an urgent link to “verify” or “restore” your account |
| Never ask for your full password or PIN by text | Ask you to type your password, PIN, or one-time code into a text or linked page |
| Never ask for your full card number by text | Ask for your full card number or online banking login |
| Let you confirm anything by calling the number on your card | Give you a phone number to call that isn’t on your card or statement |
As the FTC puts it plainly in its guidance on spam texts, “legitimate companies won’t ask for information about your account by text.” That single sentence covers almost every fake bank text you’ll ever receive.
How to verify a bank text safely, step by step
- Don’t tap the link and don’t reply, not even “STOP.” Replying tells a scammer your number is active and being read.
- Put the text aside. Don’t use any phone number or web address it contains.
- Call the number on the back of your card, or on a recent paper statement. Type your bank’s app or website address in yourself if you’d rather check that way.
- Ask directly: “Is there any problem with my account?” In most cases, there isn’t.
- Forward the scam text to 7726 (SPAM) if you’re in the US, UK, or Canada. This reports it to your phone carrier at no cost and helps block similar texts.
- Delete the text once you’ve checked.
Say this
“I don’t use links or numbers from a text I wasn’t expecting. I’ll call the number on my card myself.”
Try this
Save your bank’s real customer service number, straight off the back of your card, into your phone’s contacts today labeled “My Bank.” Then you’ll always have the right number ready, without hunting for your card during a moment of worry.
If you already tapped the link or typed in your details
Don’t wait, and don’t feel embarrassed. These texts are designed by people who send thousands of them a day.
- Call your bank right away on the number on your card and say, “I think I responded to a fake bank text.”
- Ask them to freeze or replace your card and to watch your account for unfamiliar charges.
- Change your online banking password, and any other account where you use the same password.
- Check your statements closely for the next few weeks.
- Read our calm 10-minute checklist for after you click a scam link for the full set of steps.
Related text scams to watch for
Fake bank alerts aren’t the only scam text making the rounds. A similar pattern shows up in unpaid toll text scams and fake package delivery texts, both of which use the same urgency-plus-link approach. Scammers also run a related phone version of this scam, described in our guide to the “safe account” phone scam, where a caller convinces you to move your own money into an account they control.
If you or a family member ever send money or details because of one of these texts, report it. Our guide on where to report a scam lists the right agency to contact in the US, UK, Australia, and Canada.
Protect your family from fake bank texts
Talk about this scam at your next family gathering, before anyone gets a text like this. Agree as a family that nobody will tap a link or share account details because of an unexpected text, no matter how official it looks or how much it mentions your real bank.
Our Scam-Stopper Kit (free when you join our email letter) includes a printable version of the warning signs above, sized to stick on the fridge or keep by the phone.
Where to go from here
Fake bank texts rely on catching you off guard for just a few seconds. Once you know the pattern, an urgent message plus a link, they lose their power completely. For more everyday scam patterns explained the same plain way, see our book on staying scam proof.
