How can I tell a real bank fraud alert from a fake one?

Often you can't, and you don't need to. Banks do send fraud alerts by text, and fake ones are written to look the same. The safer approach is to ignore whether the message is genuine and never act through the message itself. Check the account in your bank's own app, or call the number printed on the back of your card.

Will a bank ever ask me to read out a one-time passcode?

No. A one-time passcode is there to prove it's you, so giving it to a caller defeats its entire purpose. If someone on a call asks you to read out a code that was texted to you, end the call. That request is the clearest single sign that something is wrong, no matter how the call started.

Is it safe to reply Y or N to a fraud alert text?

Replying to a genuine alert is normally fine, and replying to a fake one mainly tells the sender your number is active. The real risk starts afterwards. If you get a phone call shortly after replying, treat that call as unverified, hang up, and dial your bank yourself.

Someone called me saying my account was compromised. What should I do?

Hang up without confirming anything, then call your bank on the number on the back of your card. A genuine bank will not mind you hanging up and calling back. No real bank will ask you to move money to a new or safe account, install screen-sharing software, or hand a card or cash to a courier.

← Is This A Scam?

Bank Fraud Alert Texts: Real or Fake?

Banks really do send fraud alerts by text, and fakes are written to look exactly like them. So this page isn't about spotting the fake. It's about one response habit that keeps you safe whether the message is real or not.

Most scam guides tell you to look for bad spelling or a strange sender. That advice fails here. A fraud alert is short, urgent and impersonal by nature, which makes it easy to copy. Plenty of genuine alerts come from numbers you don't recognise, and plenty of fake ones are word perfect.

The good news is that you never have to make that call. The message itself is almost never where money is lost. The loss happens in the phone conversation that follows.

What one of these looks like

Real and fake versions both look roughly like this, usually with your bank's name and the last four digits of a card:

FRAUD ALERT: A payment of $348.90 to an online retailer on card ending 4417 has been flagged. Reply Y if this was you, N if it was not.

Nothing in there can be verified from the outside. The card digits, the amount and the merchant can all be guessed or lifted from a data breach, and a partial card number feels like proof precisely because most people assume only a bank would know it.

The part that actually costs people money

The text is the setup. Whether you reply or not, a phone call may follow, from someone calm and helpful who says they're from the fraud team. They already know the details in the text, because they sent it. They then guide you through "securing" your account, and that is where the money leaves.

This matters even if the text was genuine. A real alert does not make the next incoming call real. Scammers time calls to land while people are already worried about their account.

Requests that are always wrong

Instead of judging the wording, judge the ask. These requests are outside a bank's normal process, so they tell you something the message never can:

Being asked to read out, type in, or forward a one-time passcode. The code exists to prove it's you. Nobody legitimate needs to hear it — not fraud teams, not branch staff, not the police.
Being asked to move money to a "safe account", "holding account", or "new account in your name". Banks freeze cards and accounts; they don't ask you to transfer your balance somewhere else.
Being asked for a full PIN, a full password, or the security code on the back of your card. A bank may ask for two characters of a memorable word. It won't ask for the whole thing.
Being asked to install an app so someone can see your screen or take control of your phone or computer.
Being told not to mention the call to branch staff, a family member, or anyone else — or being told it's a secret investigation and you must keep quiet.
Being asked to withdraw cash, buy gift cards, or hand your card to a courier who will collect it from your door.
Pressure to stay on the line, or being told the line must not be hung up. A genuine bank will always let you call back.

The habit: assume nothing, dial yourself

1Don't tap a link in the message and don't call a number printed in it. Even a genuine-looking number in a text proves nothing, because the text is the thing you're unsure about.
2Open your bank's own app — the one already on your phone — or type your bank's web address yourself. If a payment was really flagged, it will show there. Many banks let you freeze a card in the app in one tap.
3If you want to speak to someone, call the number printed on the back of your card or on a paper statement. That number is the one piece of contact information the message cannot have altered.
4Prefer a different phone if you have one, or give it a minute or two before dialing. On some landlines a call can stay connected after you hang up, so a fresh line removes any doubt about who you're talking to.
5If someone calls you first, hang up and do the same thing. Say you'll call back and then call back independently. Nobody at a real bank will object.
6If you already read out a code or moved money, call your bank immediately on the card number and say you think you were tricked into authorising it. Speed matters more than a tidy explanation.

Got a fraud alert text and not sure what to do with it?

Paste it into the free checker and see the specific red flags in it. No signup, no email.

Check a message

Why the checker says "verify directly" here

If you paste one of these into our checker, it will usually tell you to verify with your bank rather than calling it a scam. That isn't a cop-out. A genuine alert and a copy of one can contain identical text, so any tool claiming to tell them apart from the words alone is guessing, and a confident wrong answer in either direction is worse than none.

Links are a different matter. If the message contains a web address, that part can be examined, and how to check a suspicious link walks through reading one properly. A lookalike domain settles the question quickly. A clean one still doesn't make the message safe to act on.

If you already spoke to them

Don't wait to see what happens, and don't spend time working out how they knew your details. Call your bank on the number on your card, tell them exactly what you shared or approved, and ask them to secure the account. Then work through the reporting steps in order, starting with the money.

It's worth knowing that the same script gets reused elsewhere. The PayPal invoice scam works the same way: a believable message whose only real job is to get you onto a phone call with someone who sounds official.

Common questions

How can I tell a real bank fraud alert from a fake one?: Often you can't, and you don't need to. Banks do send fraud alerts by text, and fake ones are written to look the same. The safer approach is to ignore whether the message is genuine and never act through the message itself. Check the account in your bank's own app, or call the number printed on the back of your card.
Will a bank ever ask me to read out a one-time passcode?: No. A one-time passcode is there to prove it's you, so giving it to a caller defeats its entire purpose. If someone on a call asks you to read out a code that was texted to you, end the call. That request is the clearest single sign that something is wrong, no matter how the call started.
Is it safe to reply Y or N to a fraud alert text?: Replying to a genuine alert is normally fine, and replying to a fake one mainly tells the sender your number is active. The real risk starts afterwards. If you get a phone call shortly after replying, treat that call as unverified, hang up, and dial your bank yourself.
Someone called me saying my account was compromised. What should I do?: Hang up without confirming anything, then call your bank on the number on the back of your card. A genuine bank will not mind you hanging up and calling back. No real bank will ask you to move money to a new or safe account, install screen-sharing software, or hand a card or cash to a courier.

This page is informational and we aren't affiliated with any company or agency named on it. We can't tell you whether your specific message is genuine. Verify independently: open the company's official app or type their website address yourself, and call the number printed on your card, statement, or the back of your ID — never a number supplied by the message.

Want simple scam alerts for your family?

Join the early-access list. This is an idea we're testing, not an active protection service — nothing is monitored today, and joining changes nothing about your accounts.