Fake Bank Text Messages: How to Spot and Stop Them

If you got a text that looks like it's from your bank saying your account is locked, a big charge went through, or you need to "verify" your identity, treat it as fake until you prove otherwise. Real US banks don't ask you to tap a link to confirm your password, PIN, or full card number. The safest move is simple: don't tap anything in the text, and call the number on the back of your debit or credit card.

At GETSHURE, we publish plain-English books and offer protection plans that include the Getshure app to help ordinary Americans spot and shut down scams like these. Below is the practical guide we'd give a family member who just got one of these texts.

What a fake bank text usually looks like

Scammers copy the look of real bank alerts closely. The message is short, urgent, and pushes you to tap a link or call a number inside the text. Common versions include:

• Fraud alert fakes: "Did you authorize a $742.19 purchase at Walmart? Reply YES or NO." When you reply, they call you back pretending to be the fraud department.
• Account locked: "Your account has been temporarily suspended. Verify now: secure-bofa-alerts.top" (the domain is a dead giveaway).
• Zelle or wire warnings: "A Zelle transfer of $980 is pending. If this wasn't you, cancel here."
• Debit card deactivated: "Your Chase debit card has been locked for your protection. Reactivate: chase-reactivate.co"
• Login attempt: "We detected a sign-in from Houston, TX. Not you? Click here."

The link almost always goes to a look-alike domain, not the real bank. The call-back number almost always goes to a scammer with a very professional voice.

Red flags in 10 seconds

1. Urgency and fear ("act within 1 hour," "account will be closed").
2. A link in the text. Real banks mostly point you to their app or official site.
3. A domain that isn't your bank's exact one. Watch for ".top," ".co," ".help," extra dashes, or words like "secure-" or "-alerts" tacked on.
4. Any request for your full card number, PIN, online banking password, one-time code, or Social Security number.
5. Requests to "move your money to a safe account," buy gift cards, or send a wire.
6. Texts from a long email address instead of a short bank short-code.

The one rule that beats almost every bank text scam

Don't use anything inside the message. No links, no phone numbers, no reply. Instead:

1. Open your bank's official app that you installed yourself, or type the bank's address into your browser by hand.
2. Or call the number printed on the back of your debit or credit card.
3. Ask: "Did you send me a text at [time] about [subject]?" Give the agent the details. They can tell you in seconds whether it's real.

This single habit protects you from most bank impersonation scams, including the ones that start as a text and turn into a phone call.

Fake bank calls: the follow-up you need to expect

Many bank text scams are the opening move. If you reply, or if the scammer already has your phone number from a data breach, you'll get a call that sounds alarmingly real. The caller ID may even spoof your bank's actual customer service number.

Watch for these lines during the call:

• "We need to move your money to a secure holding account." Banks never do this. Ever.
• "I'm going to send you a code. Read it back to verify your identity." That code is the one-time password for your account. If you read it out loud, you just handed over the keys.
• "Don't tell the teller or the branch what this is for; it's a confidential fraud investigation." Real banks don't ask you to lie to other bank employees.
• "Install this app so our fraud team can help." Remote-access apps let scammers see and control your phone or computer.
• "Go to the ATM / crypto kiosk now." Banks don't route legitimate fraud recovery through Bitcoin ATMs.

If you hear any of these, hang up. Then call the number on your card.

What to do if you already tapped the link or gave information

Act fast, but don't panic. Here's the order:

1. Call your bank using the number on the back of your card. Tell them exactly what you clicked, typed, or said. They can lock the card, reverse transfers, and flag the account.
2. Change your online banking password and turn on two-factor authentication from a device you trust. See our guide: Two-Factor Authentication Guide.
3. Freeze your credit at all three bureaus. It's free and takes about 15 minutes total. Walkthrough: How to Freeze Your Credit at Equifax, Experian and TransUnion.
4. Report the scam. File at reportfraud.ftc.gov and, if money moved, at ic3.gov. If your identity may be exposed, start a recovery plan at identitytheft.gov.
5. Forward the fake text to 7726 (that spells "SPAM"). Most US carriers use this to shut down scam numbers.
6. Watch your statements daily for a few weeks. Small "test" charges often come before the big ones.

For a full first-hour checklist, read Just Got Scammed? What to Do in the First 10 Minutes.

How to tell a real bank alert from a fake

Real bank alerts share a few traits that fakes usually can't fake well:

Getshure app: Scam Shield caller lookup

When a scammer follows up a fake bank text with a phone call, your first question is: whose number is this? Scam Shield in the Getshure app is built for exactly that moment.

Scam Shield identifies likely scam and spam callers, helps block robocalls, and lets you look up an unknown number before you call it back. If a text tells you to "Call 1-800-XXX-XXXX to verify," you can type that number into the lookup and see whether it's flagged. If your phone rings right after you got a suspicious text, Scam Shield can warn you that the call is likely a scam before you even pick up.

Scam Shield is included with Getshure protection plans. To learn what the full app does, read The Getshure App: What It Does and What It Can't Do. On Android, you can install it from Google Play. On iPhone, use the download link in your GETSHURE order confirmation email, then sign in with the same email you used to order. Protection starts after you sign in.

No app blocks every scam text or call. But knowing that an unknown number is already reported as a scam is often the one second of hesitation that saves your money.

Related book: Don't Get Screwed by AI

Bank text scams are getting better fast, partly because AI makes it cheap to send millions of personalized messages and clone bank voices for the follow-up call. Our hardcover, Don't Get Screwed by AI ($29), walks you through the scams hitting American families right now in plain English: fake bank alerts, cloned-voice "grandparent" calls, deepfake video calls, romance scams, fake IRS and Social Security calls, and more. It's written to be read on the couch, not in a classroom, and shipped as a real hardcover so you can hand it to a parent or a spouse. Free US shipping on orders of $40+.

Simple habits that keep you off the hook

• Turn on push alerts in your real bank app for every transaction. Fake texts lose their power when you can see the truth in two taps.
• Save your bank's number as a contact from the back of your card, not from a text.
• Never read a one-time code out loud or paste it into a page you reached from a text.
• Use a password manager with a unique password for your bank. See our 2FA guide.
• Check if your email was in a breach. Scammers target people whose details already leaked. Guide: How to Check if Your Email or Password Was Leaked.
• Reduce the number of places that have your phone number. See How to Remove Your Personal Information From the Internet.
• Talk to older parents about these specific scams. Our guide: How to Protect Elderly Parents From Phone and Online Scams.

Quick checklist: you just got a bank text

1. Don't tap the link. Don't call the number in the text.
2. Open your bank app yourself, or call the number on your card.
3. If it's fake, forward the text to 7726 and delete it.
4. Report at reportfraud.ftc.gov.
5. If you tapped or shared anything, change your password, freeze your credit, and watch for follow-up calls.

Why Getshure is a practical next step

GETSHURE is a small American publisher operated by MetaWise Enterprises, LLC (Delaware file number 10336625), based at 11772 W Sample Rd, Ste 103, Ofc 240, Coral Springs, FL 33065. You can reach us at (754) 812-1679, Monday–Friday, 9 AM – 6 PM Eastern, or at contact@getshure.com. Every protection plan comes with a 30-day money-back guarantee and one-step cancel at getshure.com/cancel. Our charge shows up as GETSHURE.COM on your statement.

If you want ongoing help spotting fake bank texts and the calls that follow them, a Getshure protection plan gives you the Getshure app (with Scam Shield), and the option to add human Identity Theft Restoration if things ever go wrong. If you'd rather just read and learn, start with the book. Either way, you have a US phone number and 30 days to change your mind.

Ready to take the next step?

• Order Don't Get Screwed by AI ($29).
• See how the Getshure app works, then install it on Google Play (Android) or use the link in your order email (iPhone).
• Questions? Call (754) 812-1679 or email contact@getshure.com.