A text says Chase (or “your bank”) blocked a $2,847 Zelle transfer. Verify now. Your stomach drops. Banks do send alerts — but they almost never ask you to prove it’s you through a random link in an unsolicited SMS. Most of these messages are scams.
Why bank smishing works
Money fear is immediate. Large dollar amounts, Zelle, and words like “unauthorized” make people skip the slow path (open the real app). Scammers want either your online banking password or a phone call to a fake fraud desk that collects card data and one-time codes.
6 signs it’s fake
- A link you’ve never seen in your bank’s real emails/app notices
- Lookalike domains — extra words, hyphens, wrong TLD
- Pressure to verify within minutes or “reverse” a Zelle payment via the text
- A callback number that isn’t on your card
- Someone who called you asking for the SMS code from your bank app
- Threats to freeze the account if you don’t tap — designed to stop you from dialing the real bank
The callback / “fraud department” twist
Some texts skip the website and say: call this number immediately. You reach a calm person with a headset. They already “see” a charge. They ask for a code “to cancel it.” That code is often the key to your account. Hang up. Dial the number on the back of your card.
Zelle-specific notes
Zelle moves real money quickly and is hard to reverse. Scammers love it for that reason. Never send Zelle because a text or cold caller told you to. Confirm only inside your bank’s official app after you opened it yourself.
What to do instead
- Do not tap the link or call numbers from the message
- Open your real bank app, or dial the number printed on your card
- Never read one-time passcodes to anyone who contacted you first
- Paste the full text into ScamCheck
- If the text includes a phone number, also try PhoneCheck
- If you shared credentials, lock the account with the real bank now
PayPal, Venmo, Cash App cousins
Same rules: “you received money — claim/verify” pages are often phishing. Open the official app from your home screen. Don’t send money to reverse a mystery payment. See also our Zelle-focused guide and money-app landings under Scam checks.
One-time codes are keys — treat them like passwords
If a “banker” on the phone asks you to read the code that just arrived by SMS, hang up. That code is often the second factor protecting your account. Real fraud departments that you called on a printed number will not need you to surrender codes to a stranger who dialed you first.
What “account takeover” looks like after a successful phish
New payees, Zelle enrollments, address changes, or depleted balances. If you submitted a password on a fake page, call the bank from the card number immediately and say you may have given credentials to a phishing site. Speed matters more than embarrassment.
How to help a parent who “already verified”
Stay calm. Sit with them while they call the number on the card (not a recent text). Change passwords on a device you trust. Turn on every security alert the bank offers. Then paste the original scam text into ScamCheck together so they see the flags in plain language — it turns a scare into a lesson.
FAQ
- My bank really does text me. Fine — still open the official app to act, don’t use the SMS link.
- The caller ID said Chase. Caller ID is spoofable. It is not proof.
- Is wire different from Zelle? Both can be final. Never send either because a cold message told you to.