Smishing: Fake Bank Texts and What to Do If You Clicked the Link

A text arrives from your bank, in the same thread where your usual security codes land. It says your card has been blocked, someone has logged in from a new device, or there's a payment you don't recognize, and that you should tap a link to sort it out. You do. The page looks exactly like your bank's, you type in your login… and a little later something starts to feel wrong. If that's where you are right now, take a breath: it happens to a lot of people, and there's still plenty you can do.

This is called smishing, which is phishing by text message: a message pretending to be your bank so you'll visit a fake website, call a fake number or install an app you shouldn't. We'll go through how to tell if a text is fake, why it shows up next to your bank's real messages, how to report scam texts, and what to do today if you've already clicked or shared your details.

In this article

1. What fake bank texts look like
2. Why they land in the same thread as real texts
3. How to tell if a text is fake
4. If you clicked the link or shared your details
5. Call your bank and lock things down
6. How to get your money back if your account was emptied
7. Imagine this happens to you
8. How to protect yourself
9. Watch out for the second scam
10. When to get help

What fake bank texts look like

Smishing works because a text feels personal and urgent: you read it in seconds, usually on the go. The FTC describes it well: scammers send messages claiming there's suspicious activity on your account or a problem with a payment, with a link to a spoofed website that looks real, or with a number to call. Once you log in, they have your username and password.

The messages that keep coming back sound something like this:

• "A new device has signed in to your account. If this wasn't you, verify here." The link goes to a copy of your bank's site that asks for your login, then your card details and finally the code you've just been texted.
• "Your card has been suspended" or "you need to activate our new security feature". Same trap, with the threat that you'll lose access today if you don't act.
• "A payment of $2,400 is being processed. If this wasn't you, call this number." No link this time, just a phone number. On the other end, a friendly "fraud team" talks you through your own banking app until you've moved your money to a "safe account".
• "Download our new security app." The link installs an app that can read your texts or control your phone remotely.

Notice what they all have in common: fear, urgency and something you have to do from inside the message. Your real bank doesn't work like that.

Why they land in the same thread as real texts

This is the part that fools careful people, so don't be hard on yourself if it fooled you. Your phone groups texts by the sender name, and that name isn't always a phone number: it can be a short piece of text, like your bank's name. Scammers can fake that sender name, which is a form of spoofing, and your phone then files their message right under the genuine ones with your security codes.

Mobile networks and messaging apps keep improving their spam filters, but no filter is perfect and scammers keep changing tactics. So the idea to hold on to is simple: a text sitting in your bank's thread doesn't prove your bank sent it.

How to tell if a text is fake

You don't need to be an expert. If you stop for ten seconds before tapping anything, it usually shows:

• There's a link. Even if it looks tidy and includes something like your bank's name. A text that sends you to a website to "verify" your details is the clearest warning sign.
• It asks you to call a number to cancel something. If you didn't make that payment, your bank doesn't need you to ring a number from a text to stop it.
• It rushes you. "Today", "within 24 hours", "or your account will be closed". The pressure is there to stop you thinking.
• It asks for your password, the code you've just received, or to install something. No legitimate organization will ask for that by message.
• Something feels off: odd spelling, strange wording, a tone that isn't your bank's. These aren't always there, so a well-written text can still be fake.

If you have any doubt, don't reply and don't use anything in the message. Open your bank's app yourself or type its address into your browser. If something really is wrong, you'll see it there.

If you clicked the link or shared your details

Take it one step at a time, because what you do now depends on how far you got, and in almost every case there's still room to act:

• You only opened the link and closed the page. Usually nothing serious has happened. Don't fill anything in, delete the text and watch your account for a few days.
• You entered your username and password. Go to your bank's official app or type its web address yourself and change your password straight away. If you use that password anywhere else, change it there too.
• You gave your card details or the code you were texted. That can be enough for them to make payments or add your card to another phone. Call your bank now to freeze the card.
• You installed an app. Uninstall it, take your phone offline for a moment and tell your bank, because they may have had access to your messages or your screen.
• You called the number in the text. If they talked you into sending money or approving payments, hang up and follow the steps below. We explain how these calls work in vishing and caller ID spoofing: fake bank calls.

Falling for it doesn't make you careless. These texts are designed to look exactly like what you'd expect to see. What matters now is moving quickly.

Call your bank and lock things down

This is the step that matters most, so it's worth doing well:

1. Call your bank yourself on the number from its official website or the back of your card. Never use the number from the text. In the UK, 159 connects you to most major banks. Ask them to freeze your cards, online banking and any pending payments.
2. Ask them to try to stop or recall anything that has already gone. If a transfer hasn't reached the other account yet, or the money is still sitting there, it can still be stopped. Note the time, who you spoke to and the reference number.
3. Change your passwords from a device you trust and check whether any new device, payee or card has been added to your online banking.
4. Keep everything: a screenshot of the text with the sender and time, the fake website's address if you have it, your call log and your statements. Even if the sender was faked, it helps the investigation.
5. Report it. In the US, to the FTC at ReportFraud.ftc.gov and, if you lost money, to the FBI's IC3. In the UK, to Report Fraud (or Police Scotland on 101). We explain how in how to report a scam.

Speed really helps here. In the US, how much of an unauthorized loss you might have to bear depends mainly on how quickly you tell your bank, so don't wait until you have everything perfectly organized before calling.

How to get your money back if your account was emptied

This is where many people give up too early, and they shouldn't. The key is telling two situations apart:

• If they used your login or a code to make payments you didn't make, those are unauthorized transactions, which is what usually happens with smishing. In the US, Regulation E limits your liability mainly based on how fast you report, and the CFPB explains that your bank generally has ten business days to investigate once you tell it. In the UK, the FCA says an unauthorized payment should be refunded by the end of the next business day, unless the bank can show you acted fraudulently or failed to protect your details.
• If you sent the money yourself, because they convinced you it was the way to protect it, the rules work differently, but there's still a path. In the UK, since October 2024, banks must reimburse eligible victims of these authorized push payment scams sent by Faster Payments or CHAPS, up to £85,000, as the Payment Systems Regulator explains. In the US, ask your bank right away to recall the payment and contact the receiving bank. And if they told you the payment would stop a fraud, say so clearly in your complaint: you weren't trying to make that payment, you were trying to prevent one.

Put your complaint in writing to your bank, listing the transactions you don't recognize and explaining how the text reached you. If your UK bank says no or doesn't reply in time, you can go to the Financial Ombudsman Service for free. We go through the rules, deadlines and a complaint template in bank fraud: will your bank refund you?, and all the options depending on how the money left in can you get money back after a scam?.

Imagine this happens to you

Imagine it's a Tuesday night and a text from your bank appears, right under the last genuine code they sent you. It says your account has been locked after a sign-in from a new device and asks you to verify it through a link. You tap it, the page looks identical, and you enter your username, your password and the code that arrives. The next morning there are two transfers of $1,200 you never made.

In a case like that, the first step would be to call your bank on its official number, freeze everything and ask them to try to stop the transfers. The same day, you'd report it with screenshots of the text and the fake site, and send a written complaint saying you didn't make those payments and that you entered your details on a page impersonating your bank. It's only an example, but it shows what helps most: moving fast and explaining in detail how you were tricked.

How to protect yourself

If it hasn't happened to you, a few habits put you well ahead:

• Never log in to your bank from a link in a text. Not even if it's in the usual thread. Open the app or type the address yourself.
• Codes you receive are for you alone. If anyone asks for one, by text or over the phone, it's a scam.
• If a text asks you to call, don't call that number. Find the official one on your bank's website or your card.
• Read what you approve in the app. If they say you're "cancelling" something but the screen says "approve payment", believe the screen.
• Turn on alerts for every transaction. The sooner you see something odd, the sooner you can stop it.
• Talk about it at home, especially with older relatives. Knowing that banks don't send login links by text can save them a lot of heartache.

And whenever you get a scam text, report it even if you didn't fall for it. In the US and the UK you can forward it free to 7726, which goes to your mobile provider, as both the FTC and the UK's NCSC explain. It takes a minute and helps get those numbers blocked for everyone else.

Watch out for the second scam

After a smishing scam it's very common for someone to get back in touch. Sometimes they pose as your bank or the police, sometimes as a company that "recovers scammed money", and they ask for an upfront fee to get it all back. We completely understand wanting to fix it right now, but anyone who guarantees 100% recovery in exchange for paying first is usually the second scam. Before you pay anyone, read how to spot crypto and fund recovery scams.

When to get help

If your bank refunds you within a day or two, great: keep all your paperwork and follow through on your report. It's worth having a professional look at it when the bank refuses or doesn't reply, when you're accused of being careless, when the amount is significant, or when you sent the transfer yourself and need to move fast to try to freeze the money in the receiving account.

We are lawyers and expert investigators specialising in online scams, cryptocurrency and cybercrime, and every case is handled by a lawyer or an expert investigator. We'll go through which transactions were made, how they fit legally and what to ask your bank for, so your claim carries weight. In many cases the money is recovered, especially if you act fast. At Kironic we do everything we can to recover your money: send us your case and we'll look at it together.