How to Recognize a Bank Phishing Scam

Learn the red flags of phishing emails and texts, and the steps to verify contact before sharing account details.

  1. Check the sender address or phone number. Legitimate bank emails come from official domains (@yourbank.com, not @yourbank-alert.com or generic providers). Check carefully—scammers use lookalike addresses. Texts from your bank will show a number you recognize or a short code your bank has used before. If you're unsure, hang up and call the number on your debit card or bank statement.
  2. Watch for urgent language and threats. Phishing messages create panic: 'Your account is locked,' 'Verify now or lose access,' 'Confirm your identity immediately.' Banks rarely demand urgent action via email or unsolicited text. Real account issues usually come with a letter in the mail or a phone call from a number you can verify independently.
  3. Look for links and attachments you didn't expect. Don't click links in emails or texts claiming to be from your bank. Hover over the link (without clicking) to see where it actually goes—scammers hide malicious URLs behind innocent-looking text. Never download attachments unless you initiated contact with your bank directly. Instead, go to your bank's website by typing the address yourself or calling the number on your card.
  4. Notice vague greetings and poor grammar. Phishing emails often say 'Dear Customer' or 'Dear User' instead of your name. Your bank has your name on file and will use it. Watch for spelling errors, awkward phrasing, or inconsistent formatting—signs the message was mass-produced. Major banks employ professional writers; scammers often don't.
  5. Never give account details or passwords over email or text. Your bank will never ask for your full account number, PIN, password, or Social Security number via email, text, or unsolicited phone call. If you receive such a request, it's a scam. Real banks authenticate you through secure login portals or verified phone lines.
  6. Report the scam and monitor your accounts. Forward phishing emails to your bank's fraud team (often [email protected]—check your statement or call the number on your card for the exact address). Report phishing texts by forwarding to 7726 (SPAM). Then log into your account directly to check for unauthorized activity. Consider placing a fraud alert with the three credit bureaus if you fear your information was compromised.