That 'Fraud Alert' Text From Your Bank Might Be the Scam — Here's How to Check

A text arrives that looks exactly like it should: "Fraud Alert: Unusual activity detected on your account ending in 4471. Reply YES to confirm, or call the number below to speak with our security team." It's the kind of message millions of people get from their real bank every year — which is exactly why it works as a scam. The FTC's own 2025 fraud data shows bank impersonation is now the single costliest kind of scam pretending to be a business, and the FDIC has been warning about the specific pattern for years.

What the data actually shows

The FTC's Consumer Sentinel Network — the federal government's central fraud-report database — logged $3.5 billion in reported imposter-scam losses in 2025, according to the agency's June 15, 2026 announcement, up from $2.95 billion in 2024 as the FTC reported in its March 2025 release on 2024 fraud data. Of that, people reported losing nearly $1 billion to bank impersonators specifically — the highest total of any business-impersonation category the FTC tracks. Government impersonators took in $920 million, up from $789 million the year before. Total fraud losses across every category the FTC tracks came to roughly $16 billion in 2025, a 25% increase over 2024.

The FDIC has flagged this specific pattern for longer. Its own consumer-alert page (last updated May 27, 2026) notes that bank impersonation was already the most-reported scam type sent by text message back in 2022 — up nearly twentyfold since 2019 — and that total U.S. fraud losses reported to the FTC hit $12.5 billion in 2024, with imposter scams as the second-highest loss category that year. The FDIC puts the typical bank-impersonation victim's loss at around $3,000 per incident, separate from any identity-theft exposure.

How the scam actually works

Per the FDIC's own description, the pattern is consistent: a text or email framed as a bank security alert, built around artificial urgency, followed by a call from someone claiming to be a fraud-department representative. The FTC's summary of the costliest version of this scam is blunt: "Some of the costliest impersonation scams start with a fake security alert, often from a bank. People are convinced to move money to 'protect' it, with their losses often limited only by their available funds." Scammers also rely on caller ID spoofing — falsifying the number your phone displays so it shows your actual bank's name and number, even though the call isn't coming from the bank at all. A second, related version uses fake bank websites entirely: URLs with misspelled bank names or misplaced letters, or sites that misuse the "Member FDIC" name or logo to look official.

The verification check that actually works

Both the FDIC and CFPB give the same instruction, and it doesn't require any special tool: don't reply to the message and don't stay on the call. Hang up, then call your bank back using a number you already know is real — the one on the back of your debit or credit card, or on a past paper statement — never a number provided in the text, email, or call itself. The CFPB states the underlying rule directly: "Banks and credit unions never ask for account information through email or text message." If what you're checking is whether a bank or website is a real, FDIC-insured institution in the first place, rather than whether a specific caller is legitimate, the FDIC's BankFind Suite or the FDIC's own consumer line at 1-877-ASK-FDIC (1-877-275-3342) answers that separate question.

One instruction is worth repeating on its own: never move money to a "safe" account to protect it from fraud, and never pay with a gift card, wire transfer, or cryptocurrency to secure your account. Per the FTC's own guidance, a legitimate bank will never ask you to do either — an urgent instruction to move or transfer funds "to protect them" is, on its own, the clearest sign the call isn't real.

Red flags, gathered from FDIC and FTC guidance

• Urgency paired with a request to act immediately — reply, click, call now — before you've had time to check anything independently.
• A request for account numbers, PINs, passwords, or a one-time verification code sent to you by text or email; your bank does not ask for these this way.
• An instruction to move money to a different account "to protect it." This is a scam script, not a real security measure.
• A request to pay by gift card, wire transfer, or cryptocurrency to "secure" your account — no legitimate fraud department asks for this.
• A caller ID or sender name that matches your bank exactly. Spoofing makes this unreliable as proof on its own.

Where this fits

This is the same instinct behind confirming a bank or credit union is actually FDIC/NCUA insured before you trust it and confirming you're paying your actual biller instead of a search-ad impersonator: the free, independent way of checking who you're actually dealing with beats trusting whatever the message in front of you claims about itself. It's also the same underlying pattern behind debt settlement and credit repair scam red flags and spotting an AI-generated investment scam: urgency plus a request to move money or share credentials before you've verified anything independently.

What this isn't

This is a plain-language summary of public guidance from the FTC, FDIC, and CFPB, not a claim that ClearValue Money monitors your accounts, detects fraud, or can verify any specific call or text you receive. ClearValue Money is a publisher and has no affiliation with the FTC, FDIC, or CFPB. Scam scripts change, and the safest move with any account-related contact you didn't initiate is the same one regulators recommend: hang up, and call your bank back using a number you already know is real.