Is This Text Really From My Bank? How to Check Safely
A real bank never asks for your password, PIN, or one-time code by text — and never tells you to move money. To check a suspicious bank text, open the bank's own app or call the number on the back of your card. Don't use any link or number in the message.
By George Featherstone·AI-assisted draft, reviewed and edited by George Featherstone.
The reliable check is independent verification: open your bank’s official app yourself, or call the number on the back of your card. Do not use a link, phone number, or reply option supplied by a suspicious text.
A displayed sender name, short code, logo, polished grammar, urgency, or the presence or absence of a link cannot prove a message is genuine. Those details can be clues, but scammers can imitate or manipulate them. Verification through a channel you chose is the safer action.
A realistic fake fraud alert
An illustrative scam might say: “Did you authorize a $1,499 purchase? Reply YES to confirm or call the fraud department at 800-555-0199.” The number and wording vary. The goal is to make you respond so the scammer can continue the conversation as a helpful “bank employee.”
Real bank text vs. fake bank text
Here is the same warning, side by side, so you can see what to look for:
| What a real bank does | What a scam text does |
|---|---|
| Says “log in to the app to review a flagged charge” | Says “reply YES or call this number to confirm” |
| Never asks for your password, PIN, or one-time code | Asks for your code, PIN, or full card number |
| Never tells you to move money or buy gift cards | Tells you to move money to a “safe” account |
| Points you to the number on the back of your card | Points you to the number in the message |
The pattern is always the same: the scam runs through their channel, not yours.
The one-time code is the whole ballgame
The single most dangerous thing you can hand over is a one-time verification code. That code lets someone log in to your account as you, or reset your password, in seconds. Scammers often trigger a real code from your bank, then call pretending to be the bank and ask you to “read it back” to verify your identity. A real bank employee will never ask you to read back a code. If anyone asks for one — hang up or stop replying, and call the bank yourself.
What scammers may do next
- Ask you to confirm your name, one-time code, PIN, password, or full card number.
- Call from a number that appears to belong to your bank.
- Tell you to move money to a “safe” account or buy gift cards.
- Ask you to install remote-access software or stay on the phone while you log in.
- Pressure you not to hang up or contact the bank independently.
A real bank may contact customers about account activity, but a text’s appearance does not establish that it is real. Let the bank’s independently found app or phone number settle the question.
What information should you not provide in a text conversation?
Do not send a password, PIN, full card number, online-banking login, Social Security number, or one-time verification code in response to an unexpected message. If someone asks you to move money “for protection,” stop and contact the bank through the app or the number on your card.
What to do if you already replied or clicked
If you only replied
Stop the conversation. Do not answer follow-up questions. Block and report the message, then check your account in the official app or call the bank independently.
If you clicked a link
Close the page and do not download anything or enter more information. If you entered a password, change it through the bank’s official app or website and anywhere else you reused it.
If you shared account details or a verification code
Call the bank immediately using the number on the back of your card. Tell them exactly what you shared, review recent activity, ask about securing the account, and monitor statements for unauthorized transactions.
If money was sent
Contact the bank or payment provider immediately and ask whether the transaction can be stopped or reversed. Keep screenshots and report the incident to the FTC at ReportFraud.ftc.gov.
A simple routine for an older adult or caregiver
- Pause. No legitimate emergency is created by taking a minute to verify.
- Say out loud: “I will open the bank app myself.”
- Check for alerts in the official app, or call the number on the card.
- Tell the bank what the text said and ask whether any action is needed.
- Save a screenshot only for reporting, then block and delete the message.
Next step
Use the general scam-check guide for the same stop-and-verify routine across texts, emails, and calls. ScamBomb can help assess a suspicious bank message or screenshot; it cannot verify a bank account or replace the bank’s fraud department.