Real or fake? How to handle a bank “fraud alert” text

Many banks text you when they see an unusual purchase, often asking you to reply YES or NO to confirm it. That’s normal. A real alert names a specific purchase and asks only whether you made it.

Real alerts don’t ask you to reply with your PIN, password or a one-time code, don’t send a link to “verify your identity,” and never ask you to move money to a “safe” account.

Fake alerts copy the same format and then add a hook: a link to a login page, a request for your card number or code, or a phone number to call where a “fraud specialist” walks you through moving your money. Some are followed by a phone call that appears to come from the bank’s real number.

The FTC explains that scammers can make any name or number show up on caller ID, so a familiar number on your screen doesn’t prove the bank is calling.

Don’t tap links or call numbers in the message. Open your bank’s app, or call the number on the back of your card, and check whether there’s really an alert on your account. If the text asks only for YES or NO and you’re unsure, checking the app first costs you nothing.

The FTC notes that legitimate companies won’t ask for information about your account by text.

One-time codes exist so that only you can sign in or approve a payment. Anyone who asks you to read one back, whether they claim to be your bank, a delivery company or a buyer, is trying to get into your account or approve something in your name.

Call your bank on the number on your card right away, tell them what you shared, and ask them to lock the card or account. Change your online banking password, review recent transactions, and dispute anything you don’t recognize.