The fake bank text: is it really your bank?

Escudo guide · Updated July 2026

What the scam looks like

The banks change, the pressure never does. In the UK you will see names like Barclays, Monzo, HSBC, NatWest, Lloyds and Starling. The bank name is whatever gets you to react, so it is usually one of the big ones that a lot of people hold an account with.

The tells, one by one

• Manufactured urgency. "Now", "within the hour", "final warning", a suspicious payment. Fear rushes you, and rushing is the whole plan.
• The web address is not the bank's. Real banks use their own domain and nothing bolted onto it, like barclays.co.uk. Scammers use lookalikes such as barclays-secure.xyz, monzo-verify.info or hsbc-alert.online. If there is a word before or after the bank name, or an odd ending, it is fake.
• It asks you to "verify" or "confirm" by link. Your bank already knows who you are. It will never send you to a page to re-enter your card number, PIN or full password.
• It arrived from an unknown number, or slotted into a thread of real bank texts to look genuine. Scammers can fake the sender name, so a message sitting under "HSBC" is not proof of anything.

What a genuine bank message does

Knowing the real thing makes the fake obvious. A genuine bank text might tell you a payment went out, a login happened or a card was used abroad. What it does not do is send you to a link to re-enter your card, PIN or full password, and it does not threaten to lock you out unless you act in the next few minutes. Genuine fraud checks usually ask a simple yes or no ("did you make this payment, reply Y or N"), and even then, if you are unsure, the safe move is always the same: ignore the message and ring the number on your card. A real bank is completely happy for you to hang up and call back. A scammer is not, and that reluctance is a tell in itself.

The fake HMRC rebate and tax bill

The same trick wears a government coat. One version dangles free money: "HMRC: you are owed a tax refund of £274.50, claim it here". The other threatens you: "HMRC: you owe unpaid tax, settle today to avoid legal action". Both push you to a fake page like hmrc-rebate.xyz to type your card, address and Government Gateway details. HMRC does not text you a link to claim a refund or pay a bill. Real tax matters live in your account at hmrc.gov.uk or arrive by post. If a rebate sounds lovely or a threat makes your stomach drop, that feeling is exactly what the message was built to cause. Check by logging in to your HMRC account yourself, never through the link.

What to do, in order

1. Do not tap the link. Not even "just to look".
2. Do not ring any number in the message. If you are worried, call the number on the back of your card, or the one inside your official banking app.
3. Check your account the normal way. Open your banking app or type your bank's address yourself. If something were truly wrong, it would show there.
4. Report it, then set it aside. Forward the text to 7726 free of charge, it spells SPAM on the keypad. On iPhone you can also report it as junk.

The "safe account" trick

Some of these texts are the opening move in a phone scam. After you react, someone rings claiming to be your bank's fraud team and tells you your money is at risk, so you must move it to a "safe account" they set up for you. There is no safe account. Your bank will never ask you to move money to protect it, to send it to a support agent or to hand over a one time passcode. If a caller pressures you to move money to keep it safe, that caller is the fraud. Hang up and ring your bank yourself using the number on your card.

Already tapped the link or entered details?

• Call your bank now using the number on the back of your card, and ask them to freeze the card and watch the account.
• Change your online banking password and app passcode from the official app, not from any link.
• If you use the same password anywhere else, change it there too.
• Report to Action Fraud at actionfraud.police.uk or 0300 123 2040. In Scotland, report to Police Scotland on 101.
• Under UK rules many banks must reimburse victims of authorised push payment fraud. Ask your bank about a reimbursement claim.

Moving fast matters more than feeling embarrassed. These messages are built by professionals to catch sharp people on a busy day. If you want the calm version of these steps, read you already tapped a scam link.

What if it reaches my mum or dad?

The people most at risk are not the ones reading this guide. They are the ones who never went looking. The same fake bank script runs word for word abroad, against local banks in Spain, Portugal and Brazil. It is one playbook, translated. To see the machine behind it, read how SMS scam gangs actually operate.

That is what the Escudo app is for: it helps filter these known scam patterns on the iPhone and sets them aside in a junk folder before they are read. It cannot tell you whether one specific message is really from your bank, and it does not claim to. It does not delete anything, it only moves it out of the way, and your messages never leave your phone. No new app for your parents to learn.