The Zelle fraud alert and the fake bank text

Escudo guide · Updated July 2026

It starts with a yes or no question

The version tearing through the country right now does not open with a link at all. It opens with a text that looks exactly like a real fraud alert, because it is copying one.

You reply NO, because of course you did not send $850 to a stranger. That reply is the whole point. It tells the scammer this number is live, it is a real person, and that person is already worried about their money. You just raised your hand.

Then your cell phone rings

Seconds later a call comes in. The caller ID may even show your bank's name, because that is easy to fake. A calm, friendly "fraud specialist" says they saw your NO reply and they are going to help you reverse the payment. They sound like the good guy. They know your name. Then comes the move the entire con is built around: to "cancel" the fraudulent Zelle, they walk you through sending a Zelle payment to yourself, or they ask for the one time code your bank just texted you.

Here is the trap. Zelle is not a credit card. There is no chargeback and no reverse. Money sent on Zelle moves like cash, and it is gone the instant it lands. The payment you think is going "to yourself" is actually enrolled to the scammer, or that six digit code you read aloud just logged them into your account. Your real bank will never ask you to send yourself money, move funds to a safe account or read back a security code. The moment someone on the phone tells you to move money to keep it safe, you already have your answer. Cash App and Venmo get used the same way.

How a real Chase or Bank of America alert reads

Knowing the genuine article makes the fake obvious. A real alert from Chase, Bank of America, Wells Fargo or Citi tells you something already happened. A card was used far from home. A login came from a new device. A payment went out. It might ask you to reply YES or NO to a charge, and that is where it stops. It does not send you to a page to re-enter your full card number, your PIN or your online password, because your bank already has those. It does not threaten to lock you out in the next ten minutes. And it is completely fine with you hanging up and calling back. A scammer is not fine with that, and the reluctance itself is the tell.

When there is a link, look at the actual address. Your bank uses its own name and nothing bolted onto it, like chase.com. Scam pages hide behind lookalikes like chase-secure-login.info or a plain misspelling. Any extra word before or after the bank name, or an odd ending like .info or .xyz, means it is not the bank.

The IRS and refund flavor

Around tax season the same crew swaps the bank for the IRS. "Your tax refund of $1,290 is pending, confirm your details at irs-refund.xyz." The IRS does not text you, it does not email you a refund link and it does not take gift cards or wire transfers for a supposed debt. A text or call demanding immediate payment "to avoid arrest" is always a scam, every single time.

If you already replied, called back or sent a payment

Speed matters more than embarrassment, and the first hour is everything.

1. Call your bank now using the number on the back of your card, not any number from the text or the caller. Ask them to freeze the card and watch the account.
2. If you sent money on Zelle, Venmo or Cash App, tell them immediately and ask them to try to recall it. Recovery is not guaranteed, but the sooner you call the better your odds.
3. If you read out a code or entered your login, change your online banking password and app passcode from the official app, never from a link, and turn on two step verification.
4. Report it. Forward the text to 7726 (it spells SPAM), then file at ReportFraud.ftc.gov. If your identity may be exposed, IdentityTheft.gov gives you a recovery plan. Call 911 only if someone is in immediate danger.

For the calm, unhurried version of these steps, read you already clicked a scam link. The same crews also run the USPS package fee text, often the same week.

What this looks like at your mom's house

The people who lose the most are rarely the ones reading a guide like this. They are the ones who never went looking, who answer the callback and trust the calm voice. The single best thing you can do for your parents is one sentence, said out loud today: no matter who calls or what the caller ID says, hang up and call the bank back on the number on the card. This exact script runs in Britain as a fake text from Barclays or NatWest, proof it is one playbook translated for each country. The full picture is in how SMS scam gangs actually operate.

That is where the Escudo app helps. It filters known scam patterns on the iPhone and sets them aside in a junk folder before they are read, so fewer of these ever reach the person you love. It cannot tell you whether one specific message is a real threat, and no app can. Nothing is deleted, it is only moved out of the way, and your messages never leave your phone. No new app for your parents to learn.