Real banks do send texts. But a real bank will never ask you to reply with a code, tap a link to “unlock” your account, or move money to keep it safe. If a text asks for any of those, it is a scam. When in doubt, don’t tap anything: open your bank’s app or call the number on the back of your card.
Why these texts work
They are built to make you panic. A message about a strange charge or a locked account makes most people act first and think later. According to the FTC, people reported losing $470 million to scams that started with a text in 2024, five times more than in 2020, and fake bank “fraud alerts” were one of the most reported types. In 2025, people reported losing nearly $1 billion to scammers pretending to be banks.
Warning signs of a fake bank text
- It is urgent. “Suspicious charge,” “account locked,” “act now or lose access.”
- It has a link. The web address often looks close to your bank’s name but is not quite right, or uses a strange ending.
- It asks you to reply YES or NO. Replying tells the scammer your number is real, and is often followed by a phone call from a fake “fraud department.”
- It asks for a code, PIN or password. Your bank sends codes for you to type in yourself, never to read out or send back.
- It is not your bank. A fraud alert from a bank you do not even use is an easy giveaway.
The phone call that comes next
Many of these scams start with a text and finish with a call. The caller sounds professional and may already know your name or the last digits of your card. They will try to “protect” your money. Hang up if the caller asks you to:
- Read back a code that was just sent to your phone.
- Move money to a “safe account” or send it to yourself through Zelle or another app.
- Buy gift cards or withdraw cash.
- Install an app so they can “check” your phone or computer.
Your bank will never ask for any of these. Hang up, then call the bank yourself using the number on your card.
What to do with a suspicious text
- Do not tap the link or reply, not even STOP.
- Check for yourself. Open your bank’s app or website the way you normally do, or call the number on the back of your card. If there really is a problem, you will see it there.
- Forward the text to 7726 (it spells SPAM). This helps your phone carrier block similar messages. Then delete it.
- Report it with “Report Junk” in iPhone Messages or “Report spam” in Google Messages, and at ReportFraud.ftc.gov.
Already tapped, replied or shared something?
- Call your bank right away, using the number on your card, and tell them what happened.
- Change your passwords, starting with your bank and your email, and turn on two-step verification. Our password habits guide explains how.
- If you installed an app or let someone into your computer, disconnect it from the internet and have it checked before you use it for banking again.
We can help with that last part. We remove remote-access software, check your computer for anything else left behind, and help you secure your email and other accounts with new passwords. See our virus removal service and email and account help.
Help the people you love
Older parents and grandparents are often the targets. Share these rules with them, and read how to protect your parents from phone and text scams for the settings worth setting up together.