You’re at the grocery store, loading up your cart at Walmart, and your phone buzzes. The text says something like: “ALERT: A charge of $457.91 was attempted at BEST BUY. If you did NOT authorize this transaction, reply YES or NO.” Your stomach drops. You reach for your phone to reply immediately. Stop. Put the phone down. That text is almost certainly not from your bank, and replying to it is exactly what the person on the other end wants you to do.
This type of text message is called “smishing,” which is basically phishing but through SMS instead of email. And it is everywhere right now. In 2025, 76% of businesses dealt with smishing or scam texts, a 328% jump from prior years. It’s not slowing down. The messages are getting smarter, more convincing, and way harder to spot than they used to be. Here’s everything you need to know to protect yourself and your money.
What These Fake Bank Texts Actually Look Like
The most common version looks like a fraud alert. Something along the lines of: “Your debit card has been temporarily locked. Please reply with your card number and PIN to reactivate.” Or maybe: “A recent transaction of $500.00 has been flagged. If this was not you, call us immediately at [phone number].” They look real. They sound real. Some of them even include the name of a bank you actually use.
Here’s the thing. Your bank might send you legitimate fraud alerts. That’s what makes this so tricky. But a real alert from your bank will never ask you to reply with your PIN, your full card number, your Social Security number, or a one-time passcode. If the text is asking for any of that, it’s fake. Period.
Another version that’s been popping up more recently: you get a text saying someone requested a large transfer from your account. It asks you to reply YES or NO to approve or deny it. Once you reply, your phone rings. The caller says they’re from your bank’s fraud department and walks you through “reversing” the transaction. Except they’re not from your bank, and the reversal is actually you sending your money directly to them through Zelle, Venmo, or a similar app.
Why You Should Never Reply, Not Even to Say “Stop”
This is the part most people get wrong. You’d think replying “STOP” to an obvious spam text would make it go away. It does the opposite. When you reply to one of these messages, even with a single word, you’ve just confirmed to the scammer that your phone number is active, that a real person reads the messages, and that you’re willing to engage. That information is valuable on the Dark Web. Your number gets flagged as “live” and sold to other scammers, which means even more garbage texts headed your way.
The only correct move is to not reply at all. Don’t text back. Don’t call the number in the message. Don’t click any links. Just delete the text and block the number. That’s it.
The Zelle Trick That’s Costing People Thousands
This specific version of the scam deserves its own section because it’s incredibly effective and people keep falling for it. Here’s how it works, step by step. You get a text about a suspicious transaction. You reply. Then you get a phone call from someone who sounds professional, calm, and helpful. They say they’re from your bank’s fraud department. They tell you the unauthorized transfer went through, but you can reverse it by sending the money back to yourself through Zelle.
They walk you through it. They give you an account to send the money to. They tell you it’s your own account. It’s not. You just sent your money directly to a scammer. And because you authorized the Zelle transfer yourself, your bank may tell you there’s nothing they can do.
Here’s the rule to remember: your bank will never, ever ask you to use Zelle, Venmo, Cash App, or any money transfer service to “reverse” or “protect” a transaction. If someone on the phone tells you to do that, hang up immediately.
How to Tell a Real Bank Alert From a Fake One
Most banks that send real text alerts use what are called short codes. These are five or six digit numbers, not regular ten-digit phone numbers. Your bank can tell you exactly which short codes they use. If you get a text from a number that doesn’t match, it’s fraudulent. Simple as that.
Beyond that, here are the dead giveaways. The text creates extreme urgency, like “act now or your account will be closed.” It includes a link that looks slightly off, maybe a misspelled bank name or a weird domain like “chase-secure-login.info” instead of chase.com. The grammar might be a little strange, using “kindly” instead of “please” or addressing you as “Dear valued customer.” Though fair warning: AI-generated scam texts are getting much better at grammar, so you can’t rely on typos alone anymore.
A real fraud alert from your bank will usually just ask you to confirm or deny a transaction with a simple yes or no, and it won’t include links. If you’re ever unsure, ignore the text entirely and call the number on the back of your debit card.
The Numbers Are Staggering
According to the FTC, consumers reported losing $12.5 billion to fraud in 2024. That’s a 25% jump from the year before. The percentage of people who actually lost money went from 27% in 2023 to 38% in 2024. Impersonation scams, which includes fake bank texts, were the second highest category. People over 60 were hit especially hard. The number of older adults losing $10,000 or more to these schemes quadrupled between 2020 and 2024.
The FDIC reports that the average person who falls for a bank impersonation scam loses around $3,000, plus faces ongoing risk of identity theft. Reported bank text scams more than doubled between 2021 and 2022, going from about 13,600 reports to over 25,700. And most people never report it, so the real numbers are way higher.
Exactly What to Do If You Get a Suspicious Text
Step one: do not reply, do not click any links, and do not call any number listed in the text. Step two: delete the message. Step three: block the number. If you want to go the extra mile, forward the text to 7726 (spell out SPAM on your keypad). This goes to a reporting service that helps wireless carriers identify and block similar messages. You can also report it to the FTC at ReportFraud.ftc.gov.
If the text made you genuinely concerned about your account, here’s what to do. Flip your debit card over and call the number printed on the back. Or open your bank’s official app (the one you downloaded from the App Store or Google Play, not from a link in a text). Or drive to your local branch. Any of these will connect you with the real bank, and they can tell you in seconds whether there’s actually a problem with your account.
What to Do If You Already Replied or Clicked a Link
Don’t panic, but move fast. If you clicked a link and entered your login credentials on a fake site, change your password for that account right now. If you use that same password anywhere else (email, Amazon, Netflix, whatever), change those too. Monitor your accounts closely for the next few weeks and look for any transactions you don’t recognize.
If you sent money through Zelle, Venmo, or any transfer app, contact your bank immediately. Also file a police report. Your bank may need it as part of their investigation. The sooner you act, the better your chances of recovering anything.
Simple Things You Can Do Right Now to Protect Yourself
Turn on multi-factor authentication for your bank accounts if you haven’t already. This means even if someone steals your password, they still can’t get in without a second verification step. Most banks offer this for free through their app or website.
Enable the spam filter on your phone. On an iPhone, go to Settings, then Messages, and turn on “Filter Unknown Senders.” On Android, open the Messages app, tap the three dots, go to Settings, then Spam Protection, and turn it on. This won’t catch everything, but it helps.
Keep your phone’s operating system updated. Those updates often include security patches that help protect against malware that can be installed through malicious links.
Call your bank and ask what short codes they use for text alerts. Save that info in your phone so you know what a real alert looks like. If a text comes from a different number, you’ll know immediately that something is off.
And here’s maybe the most important tip of all: slow down. These scams work because they create panic. They want you to react before you think. A real bank is never going to penalize you for taking five minutes to verify that a message is legitimate. If someone on the phone pushes back when you say “I’m going to hang up and call the bank directly,” that tells you everything you need to know. A real bank employee will say “absolutely, go right ahead.” A scammer will try to keep you on the line.
The next time your phone buzzes with an urgent message about your bank account, take a breath. Don’t reply. Don’t click. Don’t call the number in the text. Just flip your card over and call the real number. That one habit alone could save you thousands of dollars.
