If you receive a text message from your bank about an urgent issue, such as suspicious activity on your account, your instinct may be to address it immediately and follow the instructions in the message. But acting too quickly could make you a victim of a smishing scam and put your personal and financial information at risk.
Bank text scams are one of the growing ways smishers trick people into sharing private information. These scams often create a sense of urgency, preying on fears about losing money or having an account compromised to get you to act before verifying whether the message is legitimate.
Protecting yourself from smishing starts with knowing how these scams work and recognizing the warning signs. Technology can provide an additional layer of protection, but knowing how to spot a suspicious bank text can help you avoid putting your information at risk in the first place.
From just $107.88 $24.99 for Kiplinger Personal Finance
Become a smarter, better informed investor. Subscribe from just $107.88 $24.99, plus get up to 4 Special Issues
Sign up for Kiplinger’s Free Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
What is smishing?
Smishing attacks are carried out through SMS or other text messages. Scammers often impersonate organizations you are likely to trust, including banks, credit card companies, delivery services and government agencies.
These messages typically create a sense of urgency. For example, a text appearing to come from your bank might read, "We detected suspicious activity on your account. Verify your information immediately."
Banks can be particularly convincing targets for impersonation because a warning about unusual account activity can trigger fears about losing money. That sense of urgency may prompt you to act before stopping to verify whether the message actually came from your bank.
How to tell if a bank text is fake
A fake bank text can look convincing at first glance, but there are often warning signs that something isn't right. Before you respond or click a link, watch for these common red flags:
- Unexpected requests to click a link: Scam texts often direct you to a link where you are asked to enter personal or financial information.
- Requests for passwords or verification codes: Your bank should not ask you to provide your password, PIN or verification code by text.
- Threats to lock your account: Scammers may warn that your account will be locked or restricted unless you take immediate action.
- Suspicious URLs: Look for misspellings of your bank's name, unusual characters or a web address that doesn't match your bank's official website.
- Requests to "protect" your money: A scammer may tell you to move or transfer money to keep it safe. Your bank should not ask you to transfer money to another account to protect it.
Scammers can also use SMS spoofing to make a text appear to come from your bank. Even if the sender's name or number looks familiar, don't assume the message is legitimate based on that information alone.
What to do if you get a suspicious text from your bank
If you get a suspicious text from your bank, don't click any links or reply to the message. Instead, open your bank's official app or type its website address directly into your browser.
Check your account for legitimate alerts or messages. You can also call the number printed on the back of your debit or credit card to confirm whether the bank sent the text and report the fraudulent message.
Once you've confirmed the text is a scam, report it to your bank and the Federal Trade Commission at ReportFraud.ftc.gov. You can also forward suspicious texts to 7726 (SPAM) which helps your wireless carrier identify and block similar scam messages.
After reporting the text, delete it.
How to protect yourself from smishing scams
There are several simple and free ways to protect yourself from smishing scams and keep your online accounts safe:
- Enable multifactor authentication: Use multifactor authentication when available. It adds another layer of security and can make it harder for scammers to access your account, even if they obtain your password.
- Use unique passwords: Create a different password for each account and avoid easily guessed information, such as a pet's name, child's name or birthdate. Consider using a password manager to create and store strong passwords.
- Turn on bank transaction alerts: Set up alerts for withdrawals, purchases and other account activity. These notifications can help you quickly spot transactions you don't recognize.
- Keep your devices updated: Install the latest software and security updates on your phone and other devices to help protect against known security vulnerabilities.
- Avoid clicking financial links in texts: Instead of following a link in a message, open your bank's official app or type its website address directly into your browser.
Security tools may also help enhance your protection against malicious links and text scams. For example, Surfshark features multiple security tools to help you identify suspicious messages, phishing emails and malicious websites.
The app scans incoming SMS messages to flag fraudulent smishing texts, flags dangerous URLs inside of text messages and catches impersonation attempts to help reduce smishing risks. Scam protection is included in all Surfshark plans.
Surfshark isn't the only cybersecurity provider offering tools designed to help identify potential scams. Norton offers AI-powered scam detection that can flag suspicious messages, while McAfee includes features that scan or filter potentially fraudulent texts. Features and availability vary by plan and device, so check what's included before choosing a service.
Cybersecurity software can't completely prevent a smishing scam, but it may help identify suspicious messages, malicious links and fraudulent websites before you interact with them. These tools are an added layer of protection, not a replacement for caution. They can't prevent you from voluntarily sharing a password, verification code or financial information with a scammer.
What to do if you clicked a smishing link
If you clicked a smishing link, don't enter any information and close the page immediately. Contact your bank using a trusted phone number, such as the one on the back of your debit card or on a bank statement. Let the bank know what happened, change any potentially compromised passwords and review your accounts for unauthorized transactions.
If you shared sensitive information, such as your Social Security number or a photo of your driver's license, consider freezing your credit with Equifax, Experian and TransUnion. A credit freeze can help prevent scammers from opening new accounts in your name.
If you believe your identity was stolen, report it at IdentityTheft.gov. After you file a report, you'll receive a personalized recovery plan with steps to help address the identity theft.
Treat unexpected bank texts with caution
Some bank texts are legitimate, so you don't need to ignore every message you receive. Instead, treat unexpected financial texts as alerts rather than instructions.
If a message requires you to take action, don't use the links or contact information it provides. Open your bank's official app or contact the bank directly using a trusted phone number to verify the message and determine what to do next.
Related Content
-
The 3-and-10 Rule: How Social Security Replacement Card Limits WorkThink you can get a new Social Security card whenever you lose one? Federal limits say otherwise.
-
5 Questions to Stop News Feeds From Managing Your MoneyTrue financial wisdom requires stepping back from headline news to balance the genuine risks with your own long-term perspective.
-
Should We Buy Hybrid Long-Term Care Insurance in Our 60s?Our reader wants to pay for hybrid life and long-term care policies with a pre-tax retirement account. Experts break down the numbers in this week's Wealth Wise advice column.
-
Finances Need a Steer? 5 Ways AI Can Take the WheelAI can take some of the strain out of handling everyday finances, from disciplined saving to avoiding scams, paying off debt and reaching your money goals.
-
4 Winter Weather Getaways You Won't Need a Passport forFrom soaking in hot springs under the northern lights to gliding over the snow on a dogsled, these expeditions make the most of the cold.
-
My First $1 Million: Graphic Designer, 63, Avon Lake, Ohio"This money brings me security. I don't wake up in the middle of the night, wondering how I'm going to live."
-
How to Build a 'Launch Fund' for Your Kids or GrandkidsFrom 529 rollovers to custodial accounts, financial experts explain how to set young adults up for true financial independence.
-
New DOT Rule Makes Flight Delay Compensation Harder to GetThe Department of Transportation's new rule limits your right to compensation for delayed flights.
-
You Really Need to Do This Before You Act on What the Chatbot Told YouYou can ask AI for financial advice, but it doesn't have all your details, so you should be cautious about the response. Here's a better way to approach it.
-
How to Use CDs Now: Short-Term vs Jumbo vs No-PenaltyWith the Fed hiking rates, savers can earn a substantially higher APY on CDs. Here are the three wisest ones to consider right now.
-
T-Mobile Is Offering Up to $1,000 Off the New iPhone 18 Pro. Is Now the Time to Upgrade?T-Mobile's latest iPhone deals could save you hundreds, even without a trade-in. But the biggest discount isn't always the best deal.
