Fake bank alert emails: how to spot them and what to do

Fake bank alerts work because real ones exist. Your bank may well email or text you about an unusual payment, so a message that says "Did you make this purchase?" doesn't look strange. This guide shows how the fake versions work, how banks actually contact you, what to do if you clicked, and how businesses protect the people who approve payments.

What does a fake bank alert email look like?

Most fall into four patterns. The subject lines below are illustrative examples, not quotes from real campaigns.

The FBI's November 2025 public service announcement describes how these messages feed account takeover. Criminals posing as bank staff use texts, calls and emails to get login details, including MFA codes and one-time passcodes. Fake fraud alerts claim there are unauthorized transactions and send victims to a phishing site that will supposedly stop them. Some criminals also buy search ads that lead to cloned bank login pages. Since January 2025, the FBI had received more than 5,100 complaints about this kind of account takeover, with losses exceeding $262 million.

How does the "fake fraud department" scam work?

The email or text is only the opening move. The money is usually taken on the phone.

1. The alert. You get a message about a large payment you didn't make. The FTC's 2023 Data Spotlight found that reports of texts impersonating banks were up nearly twentyfold since 2019, and that these texts may ask you to reply "yes or no" to verify a large transaction.
2. The call. "If you reply, you'll get a call from the (fake) fraud department," the FTC says. Caller ID can be spoofed to show your bank's real number.
3. The "help". The caller offers to stop the fraud. They ask for your one-time code, or they tell you to move your money to a "safe" account.
4. The loss. The FTC notes people "thought the bank was helping them get their money back." Instead, money was transferred out. The median reported loss for that scam in 2022 was $3,000.

The FDIC describes the same sequence: a text that "often looks like a bank security message and tries to create a sense of urgency," then a call from someone pretending to be the fraud department, who uses your information "to steal money from your account."

The email version works the same way, except the next step is often a link to a cloned login page, or a phone number in the message. That second form is callback phishing.

How do banks really contact you?

Real banks do send alerts. What they don't do is ask you to prove who you are through the message.

The OCC's consumer site, HelpWithMyBank, puts it directly: "Banks never ask you to verify your account information online." It adds that if you didn't start the contact, you should be cautious about sharing anything, and that "you should be the one to initiate the contact" (HelpWithMyBank).

The FTC is just as firm about codes and transfers (FTC, July 2024):

• "Never share a verification code. Ever." The FTC says no caller, "especially someone from your bank or investment company's fraud department," will ever ask for it.
• "Never move or transfer your money to 'protect it.'"
• Bank accounts have "different (and fewer) protections than credit cards." If you're tricked into moving money yourself, you may not get it back.

How do you spot a fake bank alert?

Check these before you do anything:

1. The sender's real address. Expand the From line. Fake alerts often use a display name like "Fraud Prevention Team" on an unrelated address, or a lookalike domain.
2. Where the link goes. Hover or long-press. A link to anything other than your bank's real domain is a fake. Our guide on how to check if a link is safe explains how to read a URL.
3. Whether you even bank there. Bulk fakes go to millions of people. A fraud alert from a bank you don't use is easy to dismiss.
4. What it asks for. A password, PIN, one-time code, card number or Social Security number means stop.
5. Pressure. "Your account will be closed in 24 hours" is a scare tactic. HelpWithMyBank warns not to be intimidated by messages that suggest dire consequences.
6. A phone number in the email. Use the number on your card or statement instead.

If you want to see where an email really came from, paste its headers into the Email Header Analyzer. A message "from" your bank that fails DMARC, or comes from an unrelated server, is not from your bank. For the full checklist that applies to any brand, see how to spot a phishing email.

What should you do with a suspicious bank email?

1. Don't click, reply or call. Not even to say "NO, I didn't make that purchase."
2. Check through your own route. Open your bank's app, use a saved bookmark, or type the address yourself. The FBI advises against reaching login pages through search results or ads.
3. Call if you're worried. Use the number on your card or statement. The FDIC says not to use a phone number provided by someone you don't know.
4. Report it. Many banks publish a phishing reporting address on their website. You can also report the message at ReportFraud.ftc.gov and use the report button in your mail client. Our phishing reporting guide covers Outlook, Gmail and Apple Mail.
5. Delete it.

What if you already clicked, signed in or shared a code?

Speed matters. The FBI says stolen funds are wired to accounts the criminals control, often linked to cryptocurrency wallets, which makes recovery difficult.

1. Call your bank now on the number on your card. Say your login or code was phished and ask them to stop or reverse any transactions you didn't make. The FBI suggests asking for a recall or reversal and a Hold Harmless Letter.
2. Change your online banking password, and any other account where you used the same one.
3. Check your MFA settings. Make sure no new phone or authenticator was added.
4. Review payees and transactions. Look for new payees, changed contact details and transfers you didn't make.
5. Report it at ic3.gov. The FBI asks victims of this scam to include "Account Takeover" in the description.
6. If it happened on a work device, tell IT and follow what to do after clicking a phishing link.

A one-time code doesn't protect you if you type it into the criminal's page. Some phishing kits pass your password and code to the real bank in real time; see adversary-in-the-middle phishing.

Why are fake bank alerts a business risk?

For a business, the target isn't a personal checking account. It's the online banking user who can release wires, approve ACH batches or add payees.

The business banking version

The lure changes to match the job, with illustrative subjects such as "Wire transfer on hold, action required," "ACH batch rejected," "Your token has expired," or "New payee added, review now." The link goes to a cloned business banking or payroll login page. The FBI's PSA specifically mentions cloned bank and payroll login pages. With the username, password and one-time code, the criminal can sign in and send money before anyone notices.

The same trick sits alongside business email compromise. The FBI's 2025 IC3 Annual Report recorded 24,768 BEC complaints with losses of $3,046,598,558 in 2025. Some of that starts with a stolen banking or email login, some with a fake request, and the controls overlap.

Controls for treasury and finance teams

The controls below are general good practice for business banking rather than requirements from a single source. Check which of them your bank supports.

• Sign in only through a bookmark or the bank's app. Never through an email link or a search ad.
• Dual approval. Require a second person to approve wires, ACH batches, new payees and changes to payee bank details. Ask your bank which approval and alert features it offers on your account.
• Separate roles. The person who creates a payment shouldn't be the only one who can release it.
• Payment alerts to more than one person. If a criminal is inside the account, an alert to a second inbox or phone is how you find out.
• Phishing-resistant MFA where your bank supports it, such as a hardware security key.
• Callback rule. Any request to change bank details, by email or phone, is checked on a number from your own records. Our vendor invoice fraud guide has a full procedure.
• Keep bank alerts visible. Some attackers flood an inbox with sign-up emails to bury the real alert about a transfer.

Next steps

1. Bookmark your bank's real sign-in page and stop using links in emails, for personal and business accounts alike.
2. Tell everyone who handles payments the three rules: no codes to callers, no moving money to "protect it," no sign-ins from email links.
3. Turn on dual approval and payment alerts for your business banking.
4. Check that your own domain can't be used to send fake alerts to your customers with the free DMARC Checker.
5. Put filtering in front of your mailboxes that catches spoofed senders, lookalike domains and phishing links. iBlockSpam filters phishing, spoofing and malware at the MX for Microsoft 365, Google Workspace and cPanel; see how it works.

Browse our other phishing and threat guides.