The fake bank text: is it really your bank?

Escudo guide · Updated July 2026

What the scam looks like

The bank changes, the pressure never does. In the US you will see names like Chase, Bank of America, Wells Fargo and Citi. The bank name is whatever gets you to react. If you do not even have an account there, the message still went out to you, because it went out to everyone.

The Zelle fraud alert scam

This is the one to know cold right now, because it is everywhere. It usually starts as a text that looks like a real fraud alert.

You reply NO, because of course you did not. Seconds later your cell phone rings. The caller ID may even read like your bank. A calm "fraud specialist" says they will reverse the payment, but first they need to verify your identity, or they walk you through sending a Zelle payment to yourself to "cancel" the fraud. Here is the trap: there is no reverse on Zelle. Money you send is gone like cash. The moment you send that "verification" payment, or read out a one time code, the payment goes to the scammer. Your real bank will never ask you to send money to yourself, to a "safe account" or to a support agent to fix fraud. If someone on the phone tells you to move money to protect it, that person is the fraud. The same trick runs on Venmo and Cash App.

The tells, one by one

• Manufactured urgency. "Now", "within the hour", "final warning", a suspicious charge. Fear rushes you, and rushing is the whole plan.
• The web address is not the bank's. Real banks use their own domain and nothing bolted onto it, like chase.com. Scammers use lookalikes like chase-secure-login.info or bofa-verify.xyz. If there is a word before or after the bank name, or an odd ending, it is fake.
• It asks you to "verify" or "confirm" by link. Your bank already knows who you are. It will never send you to a page to re-enter your card number, PIN or full password.
• It moves you to a phone call. The text is the hook, the call is the sting. A real fraud check does not need you to send a payment or read out a code to prove anything.
• It arrived from an unknown number, or slotted into a thread of real bank texts to look genuine. Scammers can fake the sender name, so a message sitting under "Chase" is not proof of anything.

What a genuine bank message does

Knowing the real thing makes the fake obvious. A genuine bank text might tell you a payment went out, a login happened or a card was used far from home. What it does not do is send you to a link to re-enter your card, PIN or full password, and it does not threaten to lock you out unless you act in the next few minutes. Real fraud checks usually ask a simple yes or no, and even then, if you are unsure, the safe move is always the same: ignore the message and call the number on your card. A real bank is completely happy for you to hang up and call back. A scammer is not, and that reluctance is a tell in itself.

What to do, in order

1. Do not tap the link. Not even "just to look".
2. Do not call any number in the message, and do not stay on a call that came to you. If you are worried, hang up and call the number on the back of your card, or the one inside your official banking app.
3. Check your account the normal way. Open your banking app or type your bank's address yourself. If something were truly wrong, it would show there.
4. Report it, then set it aside. Forward the text to 7726 (it spells SPAM), then report it to the FTC at ReportFraud.ftc.gov. On iPhone you can also report it as junk.

Already tapped the link, sent a payment or entered details?

• Call your bank now using the number on the back of your card, and ask them to freeze the card and watch the account.
• If you sent money on Zelle, Venmo or Cash App, tell your bank right away and ask them to try to recall it. Speed matters most in the first hour.
• Change your online banking password and app passcode from the official app, not from any link.
• If you use the same password anywhere else, change it there too.
• Report it at ReportFraud.ftc.gov and tell your bank so they can dispute any charges. For after the fact reports you can also call your local police non-emergency line. Call 911 only if someone is in immediate danger.

Moving fast matters more than feeling embarrassed. These messages are built by professionals to catch sharp people on a busy day. If you want the calm version of these steps, read you already clicked a scam link.

What if it reaches my mom or dad?

The people most at risk are not the ones reading this guide. They are the ones who never went looking. The same fake bank script runs word for word in Mexico as "su cuenta será bloqueada" and against banks in Portugal and Brazil. It is one playbook, translated. Full picture in how SMS scam gangs actually operate.

That is what the Escudo app is for: it helps filter these known scam patterns on the iPhone and sets them aside in a junk folder before they are read. It does not delete anything, it only moves it out of the way, and your messages never leave your phone. It cannot tell you whether one specific message is a real threat, and no app can. No new app for your parents to learn.