A message about suspicious bank activity can be real, but a convincing caller can also be an impostor. Pause before you transfer money, share a code, or follow a link. Contact your bank through a channel you choose.
Stop and verify the alert
A fraud alert deserves attention, but the message itself does not prove who sent it. In January 2026, the FTC advised people to end unexpected calls and independently contact the bank. Read the FTC guidance.
Pause the request
Do not transfer money, share a code, install software, or provide account details during an unexpected contact.
End the contact
Hang up or stop replying. Do not use a phone number or link supplied in the alert.
Contact your bank independently
Use the number on your card or recent statement, or open the official app you already use. Ask the fraud department about the alert.
Check the account
Review recent transactions in the official app or with the bank. Report anything you do not recognize.
Recognize the pressure tactics
An impostor may claim that a thief is draining your account, that a crime is linked to your name, or that your money must move immediately. The story may change, but the requested action matters more than the dramatic explanation.
| Request or claim | Safer response |
|---|---|
| Move funds to a “safe” account | Stop. Ask your bank through a trusted channel. |
| Read a one-time code aloud | Keep the code private. It can authorize access. |
| Install a remote access app | Decline. Contact your bank independently. |
| Keep the conversation secret | Pause and speak with someone you trust. |
Caller ID can show a familiar name or number even when a scammer calls. This is called spoofing. A familiar number, a professional tone, or personal details do not independently establish the caller’s identity. See the FTC explanation.
Impersonation remains an active concern. In October 2026, the FTC described enforcement work and the removal of websites that impersonated the agency. That announcement concerns agency impersonation, not a count of bank alerts. Read the announcement.
Protect codes and account access
A verification code is a temporary code used to confirm an account action. If an impostor obtains it, the impostor may use it to access your account. Keep it private, including from anyone who contacts you unexpectedly and claims to work for your bank. See the FTC explanation.
If you receive a code you did not request, do not approve the action or share the code. Independently contact your bank and ask whether an attempt needs attention. Use the bank’s own instructions to secure the account.
If you need to sign in, open your bank’s official app or type its known website address yourself. Avoid links in unexpected messages. The FTC also cautions that paid search results can display fake contact numbers.
A sample alert and a safer response
The alleged fraud may sound urgent, but the requested transfer and code are reasons to stop. Do not test the story by calling a number in the message. End the exchange, then call the number on your card or use your bank’s official app.
Tell the bank exactly what the message claimed. Ask whether it sent an alert, whether any transaction needs review, and what action the bank recommends. If there is a real issue, use the bank’s verified process to address it.
Already shared a code or sent money?
Contact your bank or credit union immediately through a trusted channel. Explain what you shared, which transactions you made, and whether anyone accessed your device. The FTC recommends asking the institution or payment service to stop or reverse a fraudulent payment and refund the money. Recovery is not guaranteed. Review the FTC recovery steps.
Tell the bank what happened
Identify transactions you did not make separately from payments you made because of the scam. Ask how to protect the account and dispute each transaction.
Contact the payment service
If you used a payment app, wire service, or another provider, report the fraud there too. Ask whether it can stop or reverse the payment.
Keep a record
Save the message, transaction details, dates, and case numbers. Ask how to provide evidence and how to follow the claim.
Report the scam
Tell the FTC at ReportFraud.ftc.gov. If identity information was exposed, ask the bank what further account protections it recommends.
Protections depend on the transaction and circumstances. For certain unauthorized electronic transfers, federal rules may limit your liability, and reporting delays can matter. Notify your bank promptly rather than waiting for a statement. Read the CFPB guidance on unauthorized transactions.
If you shared a code or made a payment, tell the bank the facts. Sharing a code does not make every later transfer automatically authorized. Ask the bank to investigate and explain its decision.
Make the next alert easier to check
Save a trusted contact method before you need it. Keep your bank’s official app current and locate the fraud or customer service number on your card or statement. Know how to review recent account activity without using a message link.
A trusted friend or family member can help you slow down and check the facts. The FTC says a legitimate fraud department will not require you to keep the call secret.
Sources and update
Checked November 2, 2026. This guide is general information for U.S. consumers. Bank procedures and legal protections depend on the facts.
Frequently asked questions
Can my bank send a real fraud alert?
Yes. Treat an unexpected alert as a reason to check, not as proof of the sender’s identity. Contact your bank through its official app or a number on your card or statement.
Is a familiar caller ID enough to trust the call?
No. Scammers can spoof a name or number. End the call and contact the bank using a number you find independently.
Will my bank always refund a scam payment?
No. Outcomes depend on the payment, circumstances, applicable protections, and reporting. Contact the bank immediately, explain what happened, and ask it to investigate.
What if I only shared a verification code?
Contact the bank immediately through a trusted channel. Explain what you shared and ask it to secure the account and review recent activity.