What to Do if a Text From Your Bank Is a Scam

Scam texts that impersonate banks are built to rush you into clicking, replying or sharing details. Here is an order of operations for verifying the message and reporting it.

A text warning that your bank has spotted suspicious activity gets your attention fast, and that urgency is exactly what scammers count on. The Federal Trade Commission (FTC) notes that legitimate companies do not request account details over text. What you need here is a fixed order of operations: leave the message alone, verify it through details you already have, then report it to the right places.

Why Fake Bank Texts Are So Common

Scammers launch thousands of phishing attacks every day. The goal is simple: collect a password, an account number or your Social Security number, then use it to get into your bank or email account, or sell it to other scammers. A text that appears to come from your bank works well for this because most people keep money in a bank account and react quickly to anything that looks like fraud.

The messages follow familiar scripts. A sender might claim to have noticed suspicious activity or login attempts, send a fake invoice and ask you to make contact if you did not authorize it, or dangle a refund or prize that requires a click or some personal details. Some links open a copycat login page that imitates your bank’s site and captures your username and password when you sign in.

The scale is large. In its 2024 Internet Crime Report, the FBI’s Internet Crime Complaint Center (IC3) combined 859,532 complaints of suspected internet crime and counted reported losses exceeding $16 billion, a 33% increase in losses from 2023. Phishing and spoofing drew the most complaints that year.

Step 1: Do Not Tap Links, Reply or Call the Number in the Text

Opening the text is fine. Interacting with it is not.

Do not tap any link, even to “learn more” or to check on your account. Do not reply, including with “NO” or “STOP” to cancel something; the FTC warns that replies such as “Just reply YES to confirm” are part of the scheme, and any response can signal that a real person is on the other end. Do not call the phone number shown in the message or answer survey questions it connects to.

Common mistake: people tap the link just to see whether their account is okay. That is how a fake login page captures credentials. Checking is fine, but only through the channels in the next step.

Step 2: Verify Through a Number You Already Have

If you want to know whether the message was real, reach the company at a phone number or web address you can trust on its own, such as the number on the back of your card or on a monthly statement. The FTC’s guidance is explicit: never use the contact information contained in the text itself.

Ask the bank whether the message came from them. If the text was real, you have lost a little time. If it was fake, you have confirmed it without giving up anything.

Step 3: Check Your Account for Unauthorized Activity

Sign in through your banking app or the website you normally use, not through anything the text provided. Look for transactions you do not recognize, payees you did not add, or changes to your contact details. A scam text about “suspicious activity” sometimes arrives alongside real fraudulent charges, so a review is worthwhile even if you never clicked anything.

This is also a good moment to set up notifications. Our guide to setting up bank account alerts explains how to have your bank contact you directly about transactions, which gives you an independent way to hear about problems.

Step 4: Report the Text to Your Bank and Forward It to 7726

Two reports matter here. First, tell your bank, even if you did not click or share anything. Banks track campaigns that impersonate their name, and your report adds to what they know.

Second, copy the message and forward it to 7726, which spells SPAM on a phone keypad. The FTC explains that carriers use these forwarded messages to identify and block similar texts from reaching other customers. Your phone may also have a “report junk” option that handles part of this for you.

You can go further. Many phones can filter or block messages from unknown senders, some wireless providers offer blocking tools, and some call-blocking apps screen texts as well. Delete the text once you have reported it.

Step 5: File Reports With the FTC and IC3

Report the scam to the FTC through its ReportFraud site. The FTC uses these reports to spot patterns and build cases against the people behind the scams.

Also consider filing a complaint with the IC3, the FBI-run center that collects reports of cyber-enabled crime. The FBI says to file a report even if you are unsure whether your complaint qualifies. When you file, paste the fraudulent message into the complaint description, include the phone number that sent the text, and add the date, time, time zone and whether you clicked the link. The form asks you not to enter personal identifiers such as your Social Security number or date of birth.

A report does not guarantee action. Complaints may be referred to law enforcement partners for possible investigation, and the IC3 notes that you will not be contacted directly about your filing. Still, combined with other data, these reports help the FBI track trends and, in some cases, even freeze stolen funds.

Be wary

Scammers impersonate the IC3 itself, sometimes claiming they can recover money you have lost. The IC3 will never contact you directly for information or money, and it does not work with law firms or crypto services to recover funds.

Step 6: Act Fast if You Already Clicked or Shared Details

If you tapped the link, move quickly:

1. Close the site without entering anything else.
2. Call your bank using a number you already have and explain what happened. The FBI recommends immediately notifying all financial institutions involved in relevant transactions.
3. If you entered a password you use elsewhere, change it, starting with any account that shares it.
4. Keep watching your account and report anything unauthorized.

If you shared account numbers, card details or a one-time verification passcode, tell your bank right away and ask what it can do, such as replacing a card or watching the account. Speed matters, because rapid reporting can help support the recovery of lost funds, and the FBI asks for reports on incidents that were attempted as well as those that succeeded.

Common mistake: waiting to see whether anything bad happens before reporting. Reporting an attempted scam costs nothing and creates a record. Talking it over also helps; the FTC notes that discussing an unexpected text with someone you trust can make the scam easier to spot.

How Banks Say They Really Contact Customers

The FTC’s guidance draws a clear line. Banks and other legitimate companies do not request account details over text, and they will not send a link by email or text asking you to update payment details. Banks do use one-time verification passcodes as a security factor, something you have, to confirm that it is really you; anyone who asks you to read a passcode back to them is collecting it, not verifying you.

A few habits follow from that line:

• Treat any text asking for your account number, Social Security number, password or passcode as fake until you have verified it through a channel you control.
• Reach your bank through the number on your card or statement, or through the app you installed yourself.
• Remember that impersonators can spoof phone numbers and copy a bank’s logo and message style, so familiar formatting proves nothing.

The vocabulary matters too. If a scam leads to a fraud claim, Bank Fraud Terms to Know explains the words your bank will use. And if losses do occur, A Timeline for a Stolen Debit Card lays out what to do and when.

Good questions

What happens when I forward a scam text to 7726?

7726 spells SPAM on a phone keypad. Your wireless provider uses these forwarded messages to identify and block similar texts from reaching other customers. Your phone’s report junk option offers a related shortcut.

Should I reply STOP to a suspicious text from my bank?

No. Replying can signal that a real person is on the other end, and the FTC warns that instructions such as replying YES to confirm are part of the scam. Report and delete the text instead.

I clicked a link in a fake bank text but entered nothing. What now?

Close the site, check your account through the bank’s app or website for unauthorized activity, and report the text to your bank and to the FBI’s IC3. Attempted incidents should be reported even when nothing was entered.

Can the IC3 get my money back?

No outcome is guaranteed. IC3 reports may be referred to law enforcement partners for possible investigation, and combined complaint data has in some cases helped freeze stolen funds, but you will not be contacted directly about your filing.

This guide is general information, not financial or legal advice. Bank fees, account terms and screening policies vary by bank and change over time, so check the account’s fee schedule and terms before you open it. For federal rules, see the Consumer Financial Protection Bureau and the FDIC.