Bank Dispute Text Message Scam: How to Tell a Real Alert From a Fake One

The short answer: never verify a bank message by using the link or phone number inside it. Real banks do send fraud alerts by text — but they never ask you to click a link to sign in, never ask for your password, PIN, or one-time code, and never tell you to move money to a 'safe account'. If a text worries you, close it, open your bank's official app from your home screen (or dial the number on the back of your card), and check there. That one habit defeats almost every version of this scam.

The red flags, in order of danger

1. A link or callback number that exists only in the message. A fake login page can look identical to your bank's. Never sign in through it.
2. A request for a one-time code, password, or PIN. The American Bankers Association's 'Banks Never Ask That' campaign states it plainly: banks never ask for these by text, email, or phone. Anyone asking is a scammer — including a caller who claims to be from the fraud department.
3. An instruction to move money to protect it. The FTC's rule is absolute: anyone who says you must move money to a safe account, buy gift cards, or send crypto to protect your funds is a scammer.
4. Urgency and threats. 'Your account will be closed in 30 minutes' is pressure, not procedure. Real banks do not threaten you into responding.
5. A follow-up call seconds after you reply. Fraud-prevention texts are automated; an immediate human call claiming to be the bank after you reply 'NO' is a classic escalation of this scam.

How to verify any alert in 60 seconds

1. Close the message. Do not tap, reply, or call the number in it.
2. Open your bank's app from your home screen, or type the bank's website address yourself, or dial the number printed on the back of your card.
3. Check transactions and security alerts there. If nothing matches the text, the text was fake.
4. If something does match — a real disputed charge, a real hold — handle it inside the app or on the verified call, never through the text thread.

Note the honest nuance: legitimate banks do send 'was this you?' texts, and replying to a genuine one is normal. The test is never the wording — it is the channel. A genuine alert can always be confirmed inside the official app; a scam cannot, because the scammer does not control your bank's app.

If you already clicked, replied, or shared a code

1. Call your bank immediately on the number on your card. Ask it to freeze the account, reverse any unauthorised transfers, and flag the incident. For unauthorised transfers, US Regulation E (12 CFR § 1005.11) and FCBA (15 U.S.C. § 1666) clocks start from your notice — speed protects your liability position.
2. Change passwords everywhere the same password was reused, and remove unknown devices or email-forwarding rules the scammer may have set.
3. Consider a credit freeze if personal information (Social Security number, date of birth) was shared.
4. Report it: to the FTC at ReportFraud.ftc.gov, and in the US forward the spam text to 7726 (SPAM) so carriers can block the sender.
5. Do not pay a recovery fee. Anyone who contacts you offering to recover the money for an upfront fee is running the second scam in the sequence.

The dispute angle: when the scam itself moved money

If the scam led to an unauthorised transfer, report it as unauthorised immediately — that is the strongest dispute position. If you were tricked into authorising the transfer yourself (the 'authorised scam' gap), the position is harder: Regulation E generally does not cover authorised transfers, though some banks reimburse qualifying imposter scams under network rules. File the claim anyway, in writing, with the scam evidence — and read our guide on the authorised-debit gap before assuming the outcome either way.

FAQ

Do real banks ever send fraud alert texts?

Yes — many banks send automated 'was this you?' alerts. What they never do is ask for your password, PIN, or one-time code, or ask you to click a link to sign in. Verify inside the official app.

I replied NO to a text and got a call from 'the bank'. Is that real?

Treat it as a scam until proven otherwise inside the official app. Automated fraud texts do not trigger immediate human follow-up calls; that pattern is a known scam escalation.

What is 7726?

In the US, forwarding a spam text to 7726 (SPAM) reports it to your mobile carrier, which can block the sender. It does not replace reporting to the FTC or your bank.

I shared a one-time code. Is my money already gone?

Not necessarily — call your bank on the card number immediately. Speed matters: the bank may still be able to stop or reverse transfers, and your prompt notice protects your Regulation E position.

Related reading

• The Authorised Debit Scam Gap (Regulation E) — why authorised-scam transfers are harder to recover
• Is This Refund Payment Real? — the sister scam: fake refund messages
• Scam Recovery for Elderly Parents — helping a parent after a scam, without blame
• Do Banks Actually Investigate Disputes? — what happens after you report the fraud

Sources (checked November 2, 2026): FTC guidance on bank-impersonation calls and texts and on verification codes (never share a code; never move money to 'protect' it); American Bankers Association 'Banks Never Ask That' campaign (banks never ask for passwords, PINs, or one-time codes by text/email/phone, and never pressure quick action); AARP Fraud Watch Network guidance on fake bank texts; Regulation E, 12 CFR § 1005.11 and FCBA, 15 U.S.C. § 1666 (notice clocks for unauthorised transfers and billing errors).

This guide is general information only — not legal or financial advice. Last updated: November 2, 2026.