Fake Bank Texts Are the New Scam: How to Stay Safe

The scam moved from your inbox to your phone's text messages — and it did it fast. PYMNTS Intelligence research from October 2026 found that first contact by text rose 35% in a year to 12% of scam victims, while email fell 30% to 13%. The next fake "fraud alert" you receive is more likely to arrive as an SMS than an email.

That matters because a scam that starts on your phone can finish there too. BioCatch's 2026 Global Scams report found 90% of banking scam sessions now happen entirely on mobile, up five points in a year. The scammer calls or texts, talks you through your own banking app, and the money leaves before the bank's systems see anything suspicious.

Why scammers switched to text

Email gave scammers two problems: spam filters got good, and people learned to distrust links in emails. A text arrives differently — it buzzes in your pocket with the same urgency as a message from a friend. And speed wins: PYMNTS found 43% of victims authorized a payment within one hour of first contact. The scam increasingly begins outside your bank's systems, in channels the bank can't see.

The scariest scams don't hack your account — they persuade you to move the money yourself.

That's the core of the new fraud economy. A PYMNTS Intelligence report from October 2026 found scams now account for 22.4% of fraud dollars, up from 12% in 2025. When you authorize the payment yourself, every identity check passes: the right device, the right fingerprint, the right approval. The failure isn't authentication — it's judgment under pressure.

What a fake bank text looks like

Forget the old typo-ridden spam. BioCatch's fraud intelligence team warned in October 2026 that AI has lowered the barrier to entry, letting scammers create convincing attacks "at a scale we've never seen before." Today's fakes:

• The fraud alert: "ALERT: $847.22 at APPLE STORE was flagged on your card ending 4821. Reply YES if this was you, NO to freeze." Replying starts a "verification" chat with a fake agent.
• The locked account: "Unusual activity locked your account. Verify within 24 hours: [link]" — urgency plus a link is the classic combination.
• The helpful "employee": a call or text from someone claiming to be bank staff, sometimes quoting real account details. South Korea's financial regulators warned on October 6, 2026 that scammers impersonate bank employees and dangle low-interest loans or compensation for supposed data breaches.
• The meeting invite: Belize's central bank warned on October 14, 2026 that scammers were using Google Meet calls to impersonate its representatives and demand banking credentials.

Seven red flags in any bank-related text

• Urgency and threats. "Within 24 hours," "account will be closed." Real banks inform; scammers panic you.
• A link you didn't ask for. The display text may say your bank's name; the real destination is a lookalike login page built to steal credentials.
• Requests for credentials or codes. PINs, passwords, one-time passcodes — banks never ask for these by text.
• Instructions to move money. "Transfer to a secure account," "send a test payment." There is no safe account a stranger directs you to.
• A callback number that differs from your bank's. Compare against the number on your card or in the official app.
• It arrived out of the blue. No pending transaction, no recent contact with the bank? An unexpected "fraud alert" is almost certainly fake.
• Odd sender details. Scammers spoof names and short codes, but a random mobile number is a giveaway.

Real message vs fake: a side-by-side

What banks do	What scammers do
Send short alerts: "A $24.50 charge was made. Not you? Call the number on your card."	Send detailed alerts with dollar amounts, links, and instructions to reply or click.
Never include login links in texts	Almost always include a link to a fake login page
Never ask for your PIN, password, or one-time code	Ask you to "verify" by reading back a code or entering credentials
Never tell you to transfer money to protect it	Invent "safe accounts" and "test payments"
Reach you at a number you can verify on your card or in the app	Pressure you to act now, before you can verify anything

What banks actually do — and the US/UK difference

Banks do send legitimate text alerts, which is exactly why fakes work. The difference is what the message asks of you: a real alert points you back to a channel you control — your banking app, or the number on your card. Protections also differ by country. In the UK, banks must reimburse customers tricked into authorized push payment scams (subject to conditions and caps) — though, as BioCatch's Jonathan Frost notes, reimbursement "does nothing to stop the fraud itself." In the US there is no equivalent blanket rule: if you authorized the transfer, reversing it is far from guaranteed. Either way, reporting quickly gives you the best possible chance.

If you already clicked or replied: do this now

1. Lock it down. Open your bank's official app (not the link) and change your password and security settings immediately.
2. Call your bank on the number on your card — never a number from the text. Ask them to freeze or monitor the account.
3. If you shared card details, ask for the card to be blocked and reissued.
4. Report it. In the US: ReportFraud.ftc.gov; in the UK: Action Fraud plus your bank. Reports feed the pattern-tracking that protects others.
5. Watch the account daily for a few weeks — scammers sometimes wait before using stolen credentials.

Frequently asked questions

Can a bank text me a link at all?

Occasionally — but never one that leads to a login screen or asks for credentials. Doubt a link? Ignore it and open the bank's app yourself; a real alert will be there too.

My text came from my bank's usual number. Is it safe?

Not necessarily. Scammers spoof sender names and short codes. Verify independently through your app or the number on your card.

What if the caller knew my account details?

Stolen data is cheap — breaches and phishing mean scammers often arrive with real details about you. That proves nothing about who they work for.

Will my bank refund me if I was tricked?

It depends on your country and the bank's policies. UK authorized push payment scam victims have reimbursement rights; in the US, authorized transfers are much harder to recover. Report immediately either way.

Text-message bank scams work because they borrow your bank's voice at the exact moment you're least suspicious. The defense is simple and free: make your banking app the only channel you trust, and treat every unexpected text as a performance until your app says otherwise. Set that rule once, tell your family about it tonight, and the next "fraud alert" that buzzes in your pocket becomes background noise instead of a bill.