Test the alert without trusting the sender
Why urgency is a warning sign
Real fraud teams can act quickly without asking you to move money to ‘safe’ accounts, reveal a full password or read back a sign-in code. Scammers create urgency to prevent independent verification.
Verify the event, not the caller
Ask the institution to review the account after you connect independently. Do not use caller ID as proof; names and numbers can be spoofed.
If you clicked or signed in
From a trusted device, change the affected password, revoke unknown sessions and tell the institution that credentials may have been entered on a lookalike site.
Preserve useful evidence
Keep the sender, phone number, time, link text and screenshots. Do not reopen a suspicious link just to collect more evidence.
Verify the event without verifying yourself to the caller
The safe test starts a new contact through a channel you already trust.
Incoming contact
Do not click, call back, move money or read out a password or one-time code.
Independent channel
Open the official app or use a number from the card, statement or typed official website.
Account check
Ask whether the alert exists and report exactly what the incoming contact requested or received.
Test the alert without giving the sender another clue
Verification should begin through a channel you already trust, with a short record of what the incoming contact knew and requested.
- Preserve the contact
- Save the displayed number or sender, exact wording, links, requested action and time. Do not reply merely to test whether the sender is real, and do not open a link to inspect it.
- Start a clean session
- Open the official banking app yourself or use a number from the card, statement or typed official website. Ask whether the alert or case exists without using contact details supplied in the message.
- Describe disclosure
- Tell the provider whether you clicked, installed software, approved a prompt, moved money or shared a password, card detail or one-time code. The response depends on what the contact obtained, not only what it claimed.
- Check the account
- Review recent activity, payees, devices, contact details and security alerts. If nothing is wrong, still block or report the phishing contact through the provider's supported channel when available.
An incoming caller knowing your name or part of an account detail does not prove legitimacy. Do not move money to a so-called safe account or read a security code back to the caller.
Break contact and verify independently
- Stop interacting with the incoming message or caller.
- Reach the institution through a separate, trusted channel.
- If you shared anything, say exactly what and secure the affected accounts.
Record the suspicious contact safely
- Capture the displayed sender, number, time and message without replying or opening its links.
- Note what information or action the caller requested and what, if anything, you disclosed.
- Record the result of verification through the bank's independently obtained official channel.
Questions before trusting the warning
Can a real bank ask security questions?
A bank may verify you after you contact it, but never trust an unexpected call on that basis alone. Reconnect through an official channel.
Should I reply STOP?
Not to an obviously suspicious message. A reply can confirm that your number is active.
Follow the signal if it points elsewhere
If you disclosed credentials or approved a prompt, move directly to the account-takeover containment steps.
If the physical card or number may be exposed, decide whether to freeze, cancel or replace the card.
If the contact persuaded you to send money, use the bank-transfer scam response while a recall may still be possible.
Processes, rights and deadlines depend on your location, provider and policy. Use the relevant official service for your jurisdiction.