How to check whether a call or SMS from your bank is real

"We're calling from your bank's security department. We've detected a suspicious charge and need to verify your identity." Or the SMS: "Your account will be blocked. Verify your details here." Bank impersonation is the queen of phone scams in Spain — not because scammers are tech geniuses, but because they've perfected the script: urgency, authority, and a solution that requires you to act now, without thinking.

The good news: you don't need to be able to tell a real call from a fake one on the spot. Nobody can, because the number on your screen can be faked and the scripts imitate real agents well. What you need is a method that works without you having to decide. Here it is.

The method: you hang up, you call back

It works for both calls and SMS, and has three steps:

1. Do nothing inside the incoming message. Don't give out details, don't tap links, don't press keys, don't install anything, don't read out codes that arrive. If it's a call, say goodbye politely and hang up. Nothing bad happens if you hang up on your real bank: they'll call you back or you'll sort it out through another channel.
2. Open the official channel yourself. Call your bank's number (the one on the back of your card or on their official website, typed by you), or open the bank's official app installed from the app store. Never use the number that called you or the link they sent you.
3. Check there. If there was a suspicious charge, a blocked account or a pending matter, it will show up in your transactions or the real agent will confirm it. If nothing shows up, the message was fake.

That's it. The trick is understanding why it works: you choose the channel, so the scammer doesn't care that they faked the number or cloned the bank's website. Their deception lives inside the call or the SMS; as soon as you step out of it, they're left with nothing.

This same method works for checking a notification from the tax office or Social Security, for the fake DGT fine SMS and for the fake parcel SMS. Learn it once and it works for everything.

What your real bank will never ask you for

Memorise this list, because it's the quick test when in doubt:

• Your PIN, your full password or your signing codes. Your real bank may ask you to identify yourself in THEIR app or on THEIR website; it will never ask you to dictate your passwords over the phone or by SMS.
• The codes sent to you by SMS. Those codes authorise transactions. Whoever asks for them over the phone is trying to get you to authorise a transaction that THEY started. This is the central trap of almost all bank vishing.
• That you install a remote-control app (AnyDesk, TeamViewer and similar) "to help you". No bank does that. It's the step before they empty your account in front of your eyes.
• That you make a "test" transfer or one "to reverse the fraud". Transfers you make yourself are irreversible. The bank will never ask you to move money over the phone to protect you.
• That you act without hanging up. "Don't hang up, it's urgent, if you hang up the charge will go through." Haste is the scammer's tool. Your real bank would rather you verify than obey quickly.

The most common variants and their script

• The charge you don't recognise. "There's a charge of 800 € at an electronics store, do you recognise it?" You say no, and they guide you to "reverse" it: install something, give codes, make a transfer. All the theatre after the "no" is the scam.
• The account blocked by SMS. A link to a website identical to the bank's where you enter your username and password. From then on, they operate.
• The fake employee who "protects" you. Friendly, professional, with your basic details (name, partial ID, last card digits: all of that circulates in data breaches). Professionalism verifies nothing; only the channel verifies.
• The disguised Bizum. They ask you to accept something on your phone "to verify your identity" and it's a Bizum payment request. Always check what you're accepting in the app.

What to do if you already gave out details or codes

1. Call your bank immediately (number on the back of your card) and explain what happened. Ask them to block cards, revoke pending transactions and change your login credentials.
2. Review your transactions over the following days with the app's notifications turned on.
3. Report it to the Policía Nacional or Guardia Civil with screenshots and the caller's number. INCIBE's 017 line gives free guidance.
4. Report the number in the spam numbers directory so it gets flagged.
5. You'll find the full process, with realistic expectations depending on how you paid, in how to recover money from a phone scam.

Quick questions

Doesn't the number on the screen prove it's my bank? No. Caller ID can be faked (it's called spoofing), and scammers use it precisely with real bank numbers so that looking it up seems legitimate. That's why the rule is never to decide inside the call.

What if they call and already know my name, my ID and my balance? Personal data circulates in breaches and balances can be vaguely invented ("a significant charge"). That they know things about you doesn't make them your bank. Apply the method anyway.

Can I ask them for something to verify them myself? You can ask for the agent's name and a case number... and then hang up and call the bank yourself to check. Any "verification" that happens without hanging up verifies nothing.

Will my bank be angry if I hang up on them? No. Hang up without guilt and call them back on the official number. That's exactly what their security department wants you to do.

Keep the rule in one sentence: if your bank contacts you, do nothing there; hang up, open the official channel yourself and check. Share it with those around you: it's the sentence that saves the most money in Spain.