The Fake “Fraud Alert” Text: How Smishers Target Your Bank Account

You’re sitting at home, maybe balancing the checkbook or scrolling through news on your phone, when a text message arrives. The sender appears to be your bank. It reads: “Fraud Alert: Unusual charge of $487.32 at a store in a state you’ve never visited. Reply Y if this wasn’t you, or call 1-866-555-0123 immediately.“ Your heart rate jumps. You’ve worked hard for that money. You’ve read about identity theft. So you call the number, ready to straighten things out. And that, right there, is exactly what the criminal on the other end wants.

This is smishing, the text message sibling of phishing. Smishing attacks use text messages to trick you into handing over sensitive information or downloading malware. For Americans aged 45 to 64, these scams are especially dangerous. You’re more likely to have substantial savings, multiple credit cards, and a deeply ingrained habit of responding to any message that suggests financial trouble. Scammers know this. They count on your good intentions and your desire to protect what you’ve earned.

The most common smishing scam right now is the fake fraud alert. You receive a text that looks like it’s from your bank, credit union, or major card issuer. It mentions a purchase at a big-box retailer, a cash withdrawal at an ATM you’ve never used, or a suspicious online transaction. The message creates urgency, telling you action is required immediately. The goal is to get you to do one of three things: reply with a one-time access code, click a link to a fake login page, or call a phony support number where a convincing “fraud specialist” will ask for your full card number, expiration date, and security code.

Here’s the no-nonsense truth: real banks do not text you out of the blue asking you to confirm or dispute a transaction. If there’s genuinely suspicious activity, they’ll call you or send a secure alert through their official mobile app. And even then, they will never ask for your full PIN, online banking password, or the three-digit CVV on the back of your card. They already have that information. So any text that demands those details is a scam, period.

Another nasty variation is the “Your account has been locked” message. You get a text saying something like “Due to unusual login attempts, your online access is temporarily restricted. Click here to restore.“ That link leads to a webpage that mimics your bank’s real login screen with startling accuracy. You type in your username and password, thinking you’re fixing a problem. Instead, you’ve just handed the keys to your account to a thief. Within minutes, they can log in, transfer money to a mule account, or change your contact information so you never see the alerts that come after.

What should you do when a suspicious text lands on your screen? First, don’t reply. Don’t click. Don’t call any number listed in the message. Second, contact your bank directly using the customer service number on the back of your card or the official website you’ve saved in your bookmarks. Ask if there’s any real problem. There won’t be. Third, forward the suspicious text to 7726, which is the shortcode for “SPAM” used by most wireless carriers. That helps your carrier block similar messages across their network. Fourth, if you already did click a link or gave away information, call your bank’s fraud department without delay. The faster you act, the better your chance of limiting the damage.

There’s also the question of how smishers got your number in the first place. It’s almost never personal. Data breaches, public records, even old phone directories provide billions of phone numbers. Scammers blast identical texts to tens of thousands of people in a single burst, knowing that a tiny fraction will respond. They don’t know your name, your bank, or your spending habits. They just know that panic works. So don’t feel embarrassed if you had a moment of worry. Instead, use that moment to build better habits.

For the 45-64 crowd, a few extra precautions can go a long way. Enable two-factor authentication on your bank and email accounts, but use an authenticator app rather than text message codes, because SMS codes can be intercepted by determined criminals. Check your bank statements online at least once a week, not just when the paper statement arrives. And make it a personal rule: never respond to a financial request that arrives by text. If your bank really needs you, they’ll find a way to reach you that doesn’t involve a five-digit number with a deadline.

The smishing problem isn’t going away. Criminals are getting better at crafting messages that look legitimate, with spoofed sender IDs that show your bank’s actual name. But the core logic remains the same. Your bank will never ask you to “verify” your password, PIN, or full card number through a text message. They already have that information. If a message asks for it, it’s a scam. Delete it. Block the sender. Move on with your life. The only thing those fraud alerts are trying to steal is your money, your time, and your peace of mind. Don’t give them a second of it.