Bank text message scams are on the rise and costing consumers more each year. A recent report from the Federal Trade Commission (FTC) revealed that more Americans reported imposter scams than any other type of fraud last year, with nearly $1 billion in losses, after $866 million in losses to imposter scams the year before.
A report last year by the Pew Research Center indicated that 73% of American adults had experienced some online scam or attack, with 61% receiving text message scams at least weekly that tried to get their personal information.
What Is a Bank Text Scam?
Perhaps we should start by explaining the difference between phishing scams vs. smishing scams, as there are many types of scams and several types of fraud. A phishing scam arrives through email. A smishing scam arrives through a text message (SMS) or a mobile messaging app such as WhatsApp. They both have the same intent: To trick you into revealing personal information that they can use to hack into your accounts, or they convince you to tap or click on a fraudulent link so you can “reset” a password, give the scammer access to your account, or reveal personal information that they could use to hack into your accounts themselves and steal your funds.
What These Scam Texts Actually Say
Text scams try to create a sense of urgency to get you to act without thinking about it or verifying if a message is legit. They often include a link so you can “verify” your personal information, reveal or change your passwords. In reality, the scammers are trying to trick you into giving them access to your accounts or reveal personal information they could use to steal your funds or even your identity.
Examples of bank text scams include:
- The fake fraud alert: It warns that your debit card or credit card is locked because of “suspicious activity” on your account, such as unusual transactions. It will include a link so you can “verify” your identity and confirm whether a “transaction” was legitimate. It might say “We’ve detected unusual activities on your debit/credit card. Please verify these immediately at (fraudulent link).”
- The account compromise warning: A text claims there were unsuccessful attempts to log on to your bank account online. It may include a link so you can “verify” or change your password. For example, “We’ve noticed unusual activities on your account. Please verify/change your password at (fraudulent link).”
- The information request: A text warns of suspicious activities or claims one or more of your accounts, or your debit card, have been frozen because of unusual activities. It asks you to “confirm” your personal information such as your account number, PIN, Social Security number, or the username and password for our online banking portal. For example, “Your debit card has been temporarily locked because of unusual activities. Please verify your card number and PIN to reactivate your card (fraudulent link).”
- The fraudulent transaction: A text pretending to be from your bank asks about a transaction you didn’t make. For example, “A transaction of $1,000 with (name of merchant) has been flagged as suspicious.” The message directs you to either call a number or tap on a link to dispute or approve the transaction. If you call the number, you’ll speak with a scammer who pretends to be from our bank and asks you to “confirm” your account details and personal information.
- The fake security update: A message claims there’s a critical security update for your banking app or your device and you must install or activate this change by tapping on a link. For example, “Union Bank: Important security update! Tap here to install/activate our new security feature (fraudulent link).” If you fall for this scam, they’ll most likely install spyware or malware on your device so they can steal your information and hack into your accounts.
- The one-time passcode scam: You’ve probably received legitimate one-time passcodes (ODPs) as a security feature when changing a password or setting up an online or mobile account. This text message scam relies on that familiarity. It usually happens when a scammer may have already obtained certain information through other means. For example, they may have figured out the answers to the security questions you chose when you set up your account. They just need you to give them the access they need to change your password and empty your accounts. They initiate a one-time passcode request, which is sent to your phone. They then send you a text message claiming to be from your bank and ask you to reveal the OTP to them. For example, “We’ve noticed unusual activities with your account and sent you a one-time passcode. Please reply with the code so we can secure your account.”
P2P Text Scams: These may involve a fake fraud alert, with a fraudulent link for you to “confirm” a transaction, or your account information for a person-to-person (P2P) app such as Zelle or our own P2P service, UBP2PHub. Another P2P text scam involves someone sending you a text claiming they “accidentally” sent you funds through a P2P app and ask you to send it back to them. In some cases they actually do initiate a payment, but they do so with stolen funds, or they cancel their end of the transaction. Either way, if you send the money you’rea unlikely to get it back. For example, “I sent you $500 by mistake. Could you please send it back to me? Thanks!”
Text Phishing Scams: Red Flags to Watch For
Bank text message scams all have a few things in common, starting with the need for urgency. They create some kind of threat to trick you into acting immediately, without thinking about their request. They try to convince you that you’re on the verge of losing money or have already done so.
Of course, there are other ways to spot text message scams:
- It’s from an unknown number. Text messages from us will be from (NUMBERS). In fact, you may have received a text from this number/these numbers If you receive a text out of the blue from a number that hasn’t sent you a message before, that’s a reason to be cautious—especially if it’s some kind of alert or a request for information. We recommend that you save our numbers in your list of contacts, including the numbers that send you text messages, so you can recognize that they’re legit. Keep in mind that scammers could send you a message from a number you don’t recognize; yet falsify its caller ID to make it look like the call is from your bank.
- It asks you to tap on a link to “verify” something, such as a recent transaction or your personal details. That link might take you to a phony website that’s made to look legitimate, so you’ll reveal or “update” your personal information, or login credentials.
- It asks you to install something on your device by tapping on a link, such as a “security upgrade.” If you tap on such a link, it could install malware on your device without you knowing about it. Criminals will use that malware to steal your personal information and passwords.
- Requests for passwords and one-time passcodes. We would never send you a text asking for your password. While we may send you a one-time passcode at your request, we wouldn’t send you a second text asking you to reveal that passcode.
What to Do If You Receive a Bank Text Scam
If you receive a scam text message, or if you have any reason to be suspicious, call and verify the message using a number that you know to be legitimate. We recommend storing our numbers in your contact list, which makes it easy for you to call and verify a message so you can avoid getting scammed. You can easily report text message scams by forwarding them to the FTC at 7726, which spells “spam.” Your cell phone provider may block any numbers that you report as spam.
Staying Protected Going Forward
At Union Bank, we will never request your account information or passwords via text message, email, or phone call. The only time we request personal information is when you call us, and we need to verify your identity.
We recommend you keep all your apps and software updated and use a PIN, password, or some other security method to lock your mobile devices. You can check out our Mobile Banking Security page for more information.
Work with Us to Avoid Bank Text Message Scams
If your Union Bank debit card is lost or stolen, you can report this and disable it through our mobile banking app. If you suspect a scam, you can call us at 800.753.4343. If reporting after business hours or on a weekend, call our fraud watch service at 800.472.3272. International callers can reach us at 616.564.5105.
