How to spot a fake bank text, email or phishing message
A fake bank message can use the correct logo, your name and even appear in the same text thread as genuine messages. Do not judge it mainly by spelling or presentation. Judge the action it asks you to take: unexpected links, password requests, one-time codes, remote-access software and urgent transfers are the important warning signs.
If a message worries you, do not use its link or phone number. Open the bank’s app yourself or contact the bank using a trusted number. Suspicious texts can be forwarded to 7726, and the NCSC accepts reports of suspicious emails and websites.
Treat the message itself as untrusted evidence
Phishing has moved far beyond badly written emails. Criminals can copy a bank’s colours, wording and sender name, and text-message spoofing can make a fake message appear near legitimate ones. “It looks real” is therefore weak evidence.
The safer question is: did I initiate the event this message refers to? If you did not just try to sign in, request a new card or make a payment, an urgent request to “verify” activity deserves independent checking. Open the official banking app directly rather than following the message into a website.
A fraudster may know your name, account provider and part of your card number, then claim they need a one-time code to “cancel” a payment. In reality, the code can be approving a login, a new payee or a transaction. Read the bank’s code message carefully; it often explains what the code is actually for.
Never give a code simply because the caller already knows other personal information. Data from previous breaches or social media can make a scammer sound informed without giving them control of the account.
Use one rule for unexpected security messages: do not use the link, telephone number or reply route inside the message to verify the message itself. Open the banking app from its normal icon or type the bank website yourself. The fact that a message knows your name or bank does not prove that the sender controls the bank account.
Protect codes, links and the accounts behind banking
A phishing page can closely imitate online banking and capture the credentials you enter. A phone number in the same message can route you straight to the criminal call centre. If the message claims a payment is suspicious, use the bank app, the number on the back of your card or the bank’s official website found independently.
This verification habit is more reliable than trying to inspect the web address on a small phone screen. A sophisticated fake domain can look convincing at a glance.
Opening a link does not automatically mean the bank account is compromised, but it increases the need to assess what happened next. If you entered a password, card details or other credentials, change affected passwords from a trusted device and contact the bank promptly. If you installed software, treat the device as potentially compromised until it has been checked.
The NCSC advises people who entered banking or card details after a phishing message to contact their bank straight away. If money has already moved, report the transaction and the scam circumstances, not just the suspicious message.
Treat one-time codes as descriptions of an action, not as generic identity questions. Read the code message before entering or sharing anything. If it says a new payee, login or card purchase is being authorised and you did not initiate that action, stop and contact the bank through a known channel.
Respond according to what you actually entered or installed
Banking security can be undermined if a criminal controls your email. Use a unique email password and enable two-step verification. Review forwarding rules and recovery methods if you suspect the inbox has been accessed.
This matters because an attacker may reset a banking password, delete the warning email and continue the takeover without needing to fool you again. Securing only the banking app can leave the recovery channel exposed.
The NCSC says suspicious texts can usually be forwarded free to 7726. Suspicious emails can be sent to the NCSC reporting service, and scam websites can also be reported. Reporting helps providers investigate and disrupt campaigns, but it comes after the immediate job of securing your own accounts.
Keep a screenshot if useful, but do not keep clicking the message to gather evidence. If money was lost, tell the bank immediately and use the appropriate national fraud-reporting route for your part of the UK.
If you interacted with the message, write down exactly what happened: clicked only, entered login details, entered card data, disclosed a code, installed software, or allowed remote access. Those are different risk levels and lead to different responses. Secure the email account as well as the bank if it can reset banking credentials.
Practical security drill: write a three-step response for spotting a bank phishing message before an incident occurs. Step one is to stop the risky channel; step two is to contact the bank or provider through a known route; step three is to review changes and transactions. Note the exact time and keep screenshots or reference numbers. If a suspicious event happens at 14:12, a timestamped sequence is far more useful than remembering later that something happened “in the afternoon”, especially if several accounts or devices are involved.
Report the incident and review the account afterwards
Can a fake bank text appear in the same thread as real messages?
Yes. Sender information can be spoofed, so thread placement is not proof that the message came from the bank.
Where can I report a suspicious text?
Most UK mobile providers support forwarding suspicious texts to 7726. The NCSC also provides routes for suspicious emails and websites.
What if I entered my bank password on a fake site?
Change it promptly from a trusted device, secure your email, and contact the bank using an independent trusted channel. If you shared card details or money moved, tell the bank immediately.
After the immediate security work, review recent transactions, new payees, contact-detail changes and device registrations. Keep screenshots and the bank fraud reference. That record helps if money moves later or if the first visible sign was a change to the account rather than an outgoing payment.
Practical security drill: write a three-step response for spotting a bank phishing message before an incident occurs. Step one is to stop the risky channel; step two is to contact the bank or provider through a known route; step three is to review changes and transactions. Note the exact time and keep screenshots or reference numbers. If a suspicious event happens at 14:13, a timestamped sequence is far more useful than remembering later that something happened “in the afternoon”, especially if several accounts or devices are involved.
Sources and verification
Victoria Hughes - Consumer Rights Specialist
I no longer tell people to “look for bad spelling” as the main phishing test. Good scams can be beautifully written. The stronger habit is channel separation: an unexpected message can tell you that something may need attention, but it should not dictate how you access the bank. Close the message and open the official app yourself. That single habit neutralises many fake links and phone numbers. I also treat one-time codes as the digital equivalent of a signature. If a caller asks you to read a code aloud, the safest assumption is that they are trying to authorise something. Email security matters just as much as the bank login because email often sits behind password recovery. Use a unique password and 2SV there first. If you have already clicked or entered information, do not waste time trying to decide whether the website was definitely fake. Contact the bank, explain exactly what you disclosed and secure the related accounts. The quality of the response depends on the quality of the facts you give them. I no longer use spelling mistakes as my main phishing test. The decisive question is whether the sender is trying to control your next action. A bank alert may be genuine, but you should still reach the bank independently. That single habit breaks many scams because it removes the criminal’s link, phone number and sense of urgency from the conversation.
MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.