FAKE BANK FRAUD ALERT

Is the bank fraud alert text a scam?

Probably yes. Your real bank does send fraud alerts, but they never ask you to "verify" anything by calling a number in the text or clicking a link. This is one of the most expensive scams running right now, with single victims losing five and six figures.

Check your exact message →

What it looks like

Real examples, anonymized.

      Chase Alert: Did you authorize a $493.27 purchase at Best Buy in Phoenix, AZ? Reply YES to confirm or NO to block. To speak with fraud, call 1-855-XXX-XXXX.
    

      Wells Fargo: Your account has been temporarily restricted due to suspicious activity. Verify your identity to restore access: wellsfargo-secure-id[.]com
    

The same template runs against Bank of America, Capital One, Citi, HSBC, Barclays, Lloyds, NatWest, Monzo, Revolut, UBS, Credit Suisse, Deutsche Bank, and any other major bank. The scam works the same in every country.

How the scam unfolds

It is a two-step trap.

This is the part that catches even careful people. The text itself does not steal anything. The real attack is the phone call that follows.

You get the text: "Did you authorize this $499 charge? Reply NO."
You reply NO, because you did not make that purchase.
A polished-sounding human calls within minutes. Caller ID shows your bank's real number (spoofed). They say "We saw your NO reply, let me help you secure the account."
They ask you to read out a one-time passcode that was just texted to you, "to verify it is you". The passcode is from your real bank, triggered by the scammer logging into your account.
You read it out. They drain the account, often by setting up a new payee or transferring to a "safe account" the scammer claims is yours.

Red flags

How to spot it.

They ask you to read a code out loud. No real bank will ever ask you to share a one-time passcode by phone, text, or email. The code is for you to type into the bank's own app, never to read to a person.
They ask you to "move your money to a safe account". No real bank does this. If your account is at risk, the bank locks it and tells you to go to a branch or use the app, not transfer money to a new account.
The link is not your bank's real domain. Real Chase is chase.com. Real Wells Fargo is wellsfargo.com. Scam links look like chase-secure-login.com, wellsfargo-id.help, or use a redirect.
Urgency and threats. "Your account will be permanently closed", "law enforcement is involved", "act in the next 30 minutes". Real banks give you days or weeks.
They know just enough to seem real. Your name, last four of your card, maybe a recent merchant. This data comes from breaches. It does not mean they have account access yet.
They discourage you from hanging up. "Stay on the line for your security." A real bank wants you to hang up and call back on the number on the back of your card. A scammer cannot survive a callback.

What to do

Do this instead.

Hang up. Call the number on the back of your physical card. Or open the bank's official app and use the in-app chat. This is the single rule that defeats this entire scam.
Check your account in the official app yourself. If there really is a fraudulent charge, you will see it. If there is not, the alert was fake.
Forward the text. In the US, forward to 7726 (SPAM). In the UK, forward to 7726 as well. Then delete the text.
If you already replied or called, but did not share a code or password, you are likely fine. Still call the real bank to flag the attempt.
If you shared a passcode or moved money, call your bank's fraud line right now. Time matters. The first 24 hours are when the money can sometimes be recalled. Then file a report at your country's fraud agency (US: reportfraud.ftc.gov, UK: actionfraud.police.uk).

What not to do

Never do this.

Never read a one-time code out loud. Not to a "bank rep", not to the police, not to anyone. The code is for typing into your bank's app yourself.
Never call the phone number from inside the text. Even if it looks legitimate. Use the number on the back of your card.
Never transfer money to a "safe account". No real bank ever asks you to do this. If they say this, it is a scam, with 100% certainty.
Never click the link. Even to "check what it is". The fake login page is the whole point.

Quick questions

FAQ.

What if the caller knew my name and the last 4 of my card?

That data is everywhere after years of breaches. Knowing your name, address, last 4 of card, and even your bank does not mean a real bank rep is calling. Scammers buy these lists cheaply. The test is not what they know but what they ask you for. A real bank never asks for a passcode, password, full card number, or to transfer money.

The caller ID showed my bank's real number. How?

Caller ID is trivial to spoof. Any cheap VoIP service can put any number on your screen. The number you see when someone calls you is worthless as proof. The only number you can trust is one you dialed yourself, from the back of your card or the bank's official app.

I already gave them a code. What do I do?

Call your bank's fraud line right now using the number on the back of your card. Have them lock the account and reverse any pending transfers. Change your online banking password and enable an app-based authenticator (not SMS) if your bank supports it. File a report at the fraud agency for your country.

Got a different message?

Check your exact text. It takes 5 seconds.

Free, no signup, nothing stored. Works for SMS, email, WhatsApp, links, and screenshots in 10 languages.

Check my message →