By Moti Shay · updated July 25, 2026
This is one of the most dangerous scams around: a text that looks like it's from your bank — sometimes in the same thread as its real messages — reports "suspicious activity" or a "blocked account," with a link to "verify." Often a "support agent" calls next to "help." It's all fake, and the goal is your account. Remember one rule: your bank will never ask for a code, password or confirmation via SMS link or over the phone.
Step 1 — the text: "Alert: unusual activity detected. Verify now: [link]" or "Your access will be suspended, confirm your details." The link leads to a perfect copy of your bank's site: everything you type goes to the scammers. Step 2 — the fake agent: a call follows, often showing the bank's real number (numbers are easy to spoof). The "agent" is calm, professional, sometimes knows your name — and walks you through "cancelling fraudulent transactions" or making a "security transfer"… which is really to their account.
While you're on the fake page (or on the call), the scammer logs into your bank's real site with the credentials you just gave. The bank then sends you a genuine verification code — and the fake page (or the "agent") asks you to enter or read it out. That code is the final key to your account. A code from the bank is only entered on the site or app you opened yourself — and is never read aloud.
A text's sender name can be spoofed: scammers make your bank's name appear, and the message joins the genuine thread. Same with the call: the displayed number can be faked. The message's location and the number shown prove nothing. What matters is the content: a link to click + details to enter = maximum alert.
• You're asked for a username, password or code via a link • The domain isn't the bank's official site (check it letter by letter) • An urgent threat: "account suspended," "within 24h" • A generic message ("Dear customer") with no last digits of your account • An ordinary mobile or international sender number • An odd send time (2 a.m.)
1. Don't click, don't call back the number in the text. 2. Open your bank's app yourself or type the address by hand: if there's a real problem, it'll be there. 3. If in doubt, call your branch or the number on the back of your card — and check the text in the free Phishy tool on this page: verdict in seconds. If an "agent" calls: hang up politely and call the bank yourself. A real agent will understand; a scammer will insist.
1. Call the bank immediately (number on the back of the card): freeze access and any pending transfers. 2. Change your bank password — and anywhere you used the same one. 3. Block the card if you entered its details. 4. Report the text to your fraud service, the site to your cybercrime portal, and file a police report — essential for a refund. 5. Watch the account over the next days — scammers sometimes come back.
No. A verification code is only ever entered on the site or app you opened yourself. No legitimate person will ask you to read it aloud — not an "agent," not a "fraud department."
Not necessarily. The sender name can be spoofed so the scam message joins the legitimate thread. Only the content matters: link + request for details = danger.
That's the classic fake-agent script. Hang up and call your bank yourself on the official number. Never confirm an operation requested by an incoming call.
That someone is probably trying to access your account right now. Give the code to no one and call your bank.
Copy and paste it into the Phishy checker on this page: link and text analysis, verdict in seconds, no signup.