The text says your card was used for a $780 purchase and asks you to reply YES or NO. You reply NO, and within a minute your phone rings with your bank's number on the screen. A polite "fraud specialist" says they will help reverse it. Every step from here is designed to make you hand over control.
Your real bank will never ask you to share a one-time code, give your full password or PIN, move money to a "safe account", or hand your card to a courier. If a call or text asks for any of these, hang up and call the number printed on your card.
How the scam unfolds
- The alert. A text or email about a suspicious payment, a locked account or a new device. Some ask you to reply; others link to a fake login page.
- The call. A spoofed number, a professional script and personal details bought from data leaks make it convincing.
- The ask. Read back a code "to verify you", approve a notification, install an app "for security", or transfer savings to a new account "while we investigate".
- The pressure. Stay on the line, do not tell branch staff the reason for the transfer, act before the "hackers" do.
The FTC lists bank impersonation among the most reported impostor scams, and many people lose money because the call feels like protection, not a threat.
What real banks do and never do
| Your real bank may | Your real bank will never |
|---|---|
| Text a fraud alert and ask you to confirm a transaction | Ask you to read out a one-time code |
| Call about unusual activity | Ask you to move money to another account to keep it safe |
| Freeze a card and send a replacement by mail | Send a courier to collect your card or PIN |
| Ask you to log in through the app you already use | Send a link to a login page or ask you to install remote-access software |
Spotting a fake bank text
- A link to a web address that is not your bank's own domain.
- A sender that is a random mobile number or email address.
- Urgency: "account suspended", "respond within 1 hour".
- A request to "verify" your details, card number or password.
Paste the text into our scam message checker to see which of these warning signs it contains. To check the number that called you, use the phone lookup.
The safe way to respond
- Hang up or ignore the link. It is never rude to end a call that asks for money or codes.
- Contact the bank yourself. Use the number on your card or in the official app. Scammers can hold a landline open, so use another phone or wait a few minutes.
- Check your account in the app rather than through any link.
If you already gave details or sent money
Call your bank immediately, say you were contacted by someone impersonating the bank, and ask them to block cards, stop pending payments and reset your online banking. In the U.S., unauthorized transfers are protected under Regulation E; payments you were tricked into making are handled case by case, so ask clearly and escalate if refused. In the UK, banks must reimburse most victims of these scams under the Payment Systems Regulator rules introduced in October 2024. The full steps are in our guide to what to do after sending money to a scammer.
Your bank protects your money. It never asks you to move it.
Frequently asked questions
Will my bank ever ask me to move money to a safe account?
No. There is no such thing as a "safe account" set up by your bank's fraud team. Any request to move your money elsewhere to protect it is a scam.
My bank texted about a suspicious payment. Is it real?
Banks do send fraud alerts, but real ones never ask you to click a link to log in or to read back a code. Open your banking app or call the number on your card to check.
Can I trust the number on caller ID?
No. Scammers can display your bank's real number. Hang up and call the bank yourself, ideally from a different phone or after waiting a few minutes.
Why do they ask for the one-time code?
The code authorizes a payment, a new device or a password reset that the criminal is attempting right now. Your bank will never ask you to share it.
Will I get my money back?
If you did not authorize the payment, you have strong rights in most countries. If you were tricked into sending it, it depends on the country and bank: UK banks must reimburse most such scams, while U.S. banks decide case by case.
A courier is coming to collect my card. Is that normal?
No bank sends a courier to collect cards or PINs. Do not hand anything over; call your bank and the police.
What should I do right now if I gave details?
Call your bank using the number on your card, tell them you were targeted by an impostor, and ask them to block the card, review recent payments and secure your online banking.
How do I report a fake bank text?
Forward it to 7726 in the U.S. or UK, report it to the bank's fraud team, and report to the FTC or Action Fraud. Then delete it.
Sources
- FTC: How to avoid bank impersonation scams
- FTC: Impersonation scams data spotlight
- UK Payment Systems Regulator: APP scam reimbursement
- CFPB: Electronic Fund Transfers (Regulation E)
- UK Finance: Take Five to Stop Fraud
Figures are the latest available from each source at the time of writing. We review guides when official data or rules change. Spotted an error? Tell us.