How to check whether a call or text from your bank is real

How to check whether a call or text from your bank is real

"We're calling from your bank's fraud team. We've detected a suspicious transaction and need to verify your identity." Or the text: "Your account has been suspended. Verify your details here." Bank impersonation is a classic phone scam, not because scammers are tech geniuses, but because they've perfected the script: urgency, authority and a solution that requires you to act right now, without thinking.

The good news: you don't need to be able to tell a real call from a fake one on the spot. Nobody can, because the number on your screen can be faked and the scripts imitate real bank staff well. What you need is a method that works without you having to make that judgement. Here it is.

The method: you hang up, you call back

It works for calls and texts alike, and has three steps:

1. Do nothing inside the incoming call or message. Don't give out details, don't tap links, don't press keys, don't install anything, don't read out codes you receive. If it's a call, say goodbye politely and hang up. Nothing bad happens if you hang up on your real bank: they'll call back or you'll sort it out another way.
2. Open the official channel yourself. Call your bank on the number on the back of your card or on its official website (typed in by you), or open your bank's official app, installed from the app store. Never use the number that called you or the link they sent.
3. Check there. If there really was a suspicious transaction, a frozen account or something pending, you'll see it in your transactions or a genuine staff member will confirm it. If there's nothing there, the call or message was fake.

That's it. The trick is understanding why it works: you choose the channel, so it doesn't matter that the scammer faked the number or cloned the bank's website. Their deception lives inside the call or the text; the moment you step outside it, they've got nothing.

The same method works for checking a message from the ATO or myGov, a fake unpaid toll or fine text, or a fake parcel text; our guides walk through the ATO and parcel cases step by step. Learn it once and it works for everything.

What your real bank will never ask you for

Memorise this list, because it's the quick test whenever you're in doubt:

• Your PIN, your full password or your security codes. Your real bank may ask you to identify yourself in ITS app or on ITS website; it will never ask you to read out your passwords over the phone or send them by text.
• The codes it sends you by text. Those one-time codes authorise transactions. Anyone asking for one over the phone is trying to get you to approve a transaction THEY started. That's the central trap in almost every bank phone scam.
• For you to install a remote access app (AnyDesk, TeamViewer and the like) "so they can help". No bank does that. It's the step before they empty your account in front of your eyes.
• For you to make a "test" transfer, or move your money to a "safe account" to "stop the fraud". Transfers you make yourself are very hard to reverse. Your bank will never ask you to move money over the phone to protect it.
• For you to act without hanging up. "Don't hang up, it's urgent, if you hang up the payment will go through." Pressure is the scammer's tool. Your real bank would rather you check than obey quickly.

The most common variations and their script

• The transaction you don't recognise. "There's an $800 purchase at an electronics store, do you recognise it?" You say no, and they guide you to "reverse" it: install something, give them codes, make a transfer. Everything after that "no" is the scam.
• The frozen account text. A link to a site identical to your bank's, where you enter your username and password. From then on, they're in control.
• The fake employee who "protects" you. Friendly and professional, with your basic details (name, date of birth, address, the last digits of your card: all of that circulates in data breaches). Professionalism verifies nothing; only the channel does.
• The disguised approval. They ask you to approve something on your phone "to verify your identity", and it's actually a payment, a new payee or a new device on your account. Always read exactly what you're approving in the app.

What to do if you've already given details or codes

1. Call your bank immediately (on the number on the back of your card) and explain what happened. Ask them to block your cards, stop pending transactions and reset your login details.
2. Watch your transactions over the following days, with app notifications turned on.
3. Report it to police through ReportCyber, which you'll find via the AFP's cybercrime page, with screenshots and the caller's number, and to Scamwatch, the national scam-reporting service. IDCARE (1800 595 160) offers free support if your identity details were exposed.
4. Report the number in the spam numbers directory so it gets flagged. If the scam arrived by text and you're with Telstra, you can also report it as explained on Telstra's scams page.
5. Your chances of getting money back depend on how it left your account; you'll find more on what to do after a scam on our blog. If you're not happy with how your bank handles it, you can complain to the Australian Financial Complaints Authority (AFCA).

Quick questions

Doesn't the number on the screen prove it's my bank? No. Caller ID can be faked (that's called spoofing), and scammers use it precisely with real bank numbers, so that looking the number up makes the call seem legitimate. That's why the rule is never to decide inside the call.

What if they already know my name, my date of birth and my balance? Personal details circulate in data breaches, and balances can be vaguely invented ("a significant transaction"). Knowing things about you doesn't make them your bank. Apply the method anyway.

Can I ask them for something so I can check them myself? You can ask for the person's name and a reference number... then hang up and call the bank yourself to check. Any "verification" that happens without hanging up verifies nothing.

Will my bank mind if I hang up on them? No. Hang up without guilt and call back on the official number. That's exactly what their fraud team wants you to do.

Keep the rule in one sentence: if your bank contacts you, do nothing there; hang up, open the official channel yourself and check. Share it with the people around you: it's the simplest habit for keeping your money where it belongs.