Your bank will contact you sometimes, and so will scammers pretending to be your bank. The skill that matters is telling them apart, and it comes down to a few reliable habits.
What follows is aimed squarely at everyday phone users, and it assumes no prior know-how. Each step is numbered and pictured, so even a buried setting is easy to find. Keep your phone in hand and do each step as it comes.
We’ll start with the fastest, highest-value checks and move toward the more thorough ones, so even the first few minutes are well spent. Where a real tool helps, we link straight to the official one — never a sketchy third-party site.
In short: know what real banks never do, check the sender and links carefully, verify through your own channel, and act if you already engaged. Keep reading for the click-by-click version, with an illustration at each stage.
Option 1: Read the Tells
You won’t need any technical skill for this — just your phone and a couple of minutes. The steps are ordered so you never have to double back.
1Know what real banks never do
Genuine banks don’t ask for your full password, PIN, or one-time codes, and don’t pressure you to move money ‘to a safe account’ or grant remote access. Any message or call demanding these is a scam, regardless of how official it looks.
These hard rules cut through most impersonation instantly.
The pressure is the product. Any message engineered to make you act in the next sixty seconds deserves exactly the opposite: a slow, skeptical second look.
- Real banks never ask for your full password, PIN, or codes
- Pressure to move money or grant access means scam
2Check the sender and links carefully
Scam texts come from random numbers and link to lookalike sites, not your bank’s real domain. Don’t trust the displayed sender or tap the link; the details rarely hold up to a close look.
A mismatch between the claimed bank and the actual sender or link is your answer.
Once you’ve seen a few, the mismatched sender becomes the fastest tell of all — a real company simply doesn’t text you from a different random number each time.
- Distrust random senders and lookalike links
- A sender/link mismatch reveals the scam
Option 2: Confirm It
Here’s the practical, click-by-click version. Do the steps in sequence on your own phone as you read, and let the images guide each tap.
3Verify through your own channel
If there’s any doubt, contact the bank yourself using the number on your card or in their official app — never the number or link the message provided. The bank can confirm whether the contact was genuine.
Reaching them your own way sidesteps the impersonation entirely.
Reaching the company through its own app or a web address you typed yourself sidesteps the entire trick, because you never touch the attacker’s link.
- Call the number on your card or use the official app
- Never use the contact details the message gave
4Act if you already engaged
If you shared details or moved money, contact your bank right away through official channels, change your banking password from a clean device, and report the scam. Fast action gives the best chance of limiting loss.
Banks have fraud processes; the sooner you reach them, the better.
Reporting does more than clear your inbox — it feeds the filters that protect everyone, so it’s a small civic good as well as a personal one.
- Contact your bank now and change banking passwords
- Report the scam; speed limits the loss
Warnings
- Anyone asking for your full password, PIN, or one-time code is a scammer, even if they claim to be your bank.
- Pressure to ‘move money to a safe account’ is a hallmark of bank-impersonation fraud.
Good Habits
- Your bank’s official app is a trustworthy channel to check for genuine alerts.
- Always verify by calling the number on your card, never the one a message gives.
Frequently Asked Questions
The caller knew some of my details — does that prove it's my bank?
No. Scammers often have details from breaches to seem credible. Genuine details don’t verify a caller; only contacting the bank through your own channel does.
I gave a scammer my banking info — what now?
Contact your bank immediately through official channels, change your banking password from a clean device, and report it. Act fast to limit any loss.
How do I know if a message is really from my bank?
Real banks never ask for your full password, PIN, or one-time codes, or pressure you to move money. When in doubt, contact the bank using the number on your card — not the message’s details — to verify.
Useful Links
These first-party tools let you check and lock things down directly:
- Google Security Checkup — open it to check or manage this yourself.
- Have I Been Pwned — open it to check or manage this yourself.
- Google Play Store — open it to check or manage this yourself.
- Apple App Store — open it to check or manage this yourself.
You don’t have to be perfect to be much safer. Even the first method here closes the most common door, and the rest are there whenever you’re ready.
Make Privacy a Habit
Catching a problem is good; preventing the next one is better. The short routine below keeps your phone genuinely hard to watch, and it takes only a few minutes a month.
Add two-factor authentication to your key accounts, starting with email, and you’ve covered the vast majority of realistic risks. Come back to the methods above any time something feels off.
Why This Is Worth Doing
The reason these steps work is that they target how monitoring actually happens in practice, not the dramatic movie version. Ordinary people are followed through ordinary settings, and ordinary settings are exactly what you’ve just learned to control.
Common Mistakes to Avoid
- Assuming an unfamiliar name is harmless without checking it, or deleting a real system component in a panic.
- Reusing the same password across accounts, so fixing one login leaves the others just as exposed.
- Trusting a flashy ‘detector’ app from outside the official store, which is a common disguise for the very thing you’re trying to remove.
- Stopping after one step — the doors work together, so a single fix often leaves another open.
When to Get Extra Help
There’s no shame in asking for help if the steps here don’t fully settle your mind. Official support channels for your phone can walk through settings with you, and if safety is part of the picture, a support service that handles tech abuse is the right call.
Quick Recap
To bring it together for everyday phone users, here’s the whole process at a glance:
- Know what real banks never do
- Check the sender and links carefully
- Verify through your own channel
- Act if you already engaged
None of it is hard on its own — it’s just a sequence, and now you have it.
Good to Know
- Your email account is the master key to everything else, since it can reset most other passwords; protecting it first protects the rest by extension.
- Updates are unglamorous but powerful — most sneaky monitoring leans on security holes that updates quietly close, so keeping automatic updates on does a lot of the work for you.
- Two-factor authentication is the closest thing to a single high-impact fix: it makes a stolen password almost useless on its own.
- Reusing passwords is what turns one company’s breach into your problem across many accounts, so unique passwords are less about that one site and more about containment.
These are the principles the individual steps grow from, so they’re worth keeping in mind even after the details fade.