Bank phishing scam: how to spot fake messages

What is a bank phishing scam?

A bank phishing scam tries to trick you into giving away details the fraudster needs to take over your account. You might see these messages claim they're from your bank, a transfer service you use, or even a foreign exchange provider. Most want your login details, card numbers or a one-time security code.

You could get a phishing attempt by email, by text (that's sometimes called smishing), or by phone call (that's called vishing). And often, these messages pressure you with something urgent, like saying your account’s frozen or warning that a transfer needs you to act fast. If you click a link, share a code, or fill out a fake sign-in page, the criminal can slip in and pretend to be you.

Banks aren't the only targets. Money transfer platforms and crypto exchanges get used for these scams as well. If you want a broader view, see common money transfer scams.

Red flags that point to a phishing message

Some warning signs come up repeatedly:

Messages that say you have to act right now, often counting down the minutes.
Greetings that don’t match your name or just say “Dear customer.”
Sender addresses that aren’t quite right, like one extra letter or a word in the web address.
Requests for sensitive information, especially your password, PIN, entire card number or a fresh security code.
Attached files you didn’t ask for, especially those that ask you to turn on macros or download an app.

And be cautious about caller ID or sender names. Fraudsters can fake a business name or even a real-looking phone number, so it appears legit on your screen. And if someone mentions details that only your bank should know: keep in mind, criminals sometimes get that data by buying old payslips or hacking smaller sites first.

How to verify a message safely

If you’re not sure about a message’s real source, don’t reply and don’t use any phone number or link from it. There’s a safer way to check:

Log directly into your provider’s app or enter their website address in your browser. Don’t tap any link from the message.
Use the phone number printed on your debit or credit card, or shown on the official website, skip numbers in the message itself.
And remember, a legitimate bank or payment provider will never ask for your full password or to read out a security code you’ve just received.

Want an extra safeguard? Learn about two-factor authentication methods. If you’ve already shared confidential details, call your provider using their official line immediately, update your password, and report the incident. Most large banks and payment companies have a special inbox to handle phishing, find that address on their official website.

Frequently asked questions

Can a phishing message come from a real phone number?

Yes, it’s possible. Caller ID and sender names can be made to look real, so any call or message might appear genuine. You should always hang up and use the official phone number from your card or your provider’s website instead.

What should I do if I shared a code or password?

You need to act quickly. Reach out to your bank or payment provider on its official phone number right away, ask that it blocks anything suspicious, and update passwords for any account that used the information you’ve shared. Keep a written record of what you disclosed, in case it’s needed for a claim later on.