How to check whether a call or SMS from your bank is real

How to check whether a call or SMS from your bank is real

"We're calling from your bank's fraud department. We've noticed a suspicious debit and need to verify your identity." Or the text: "Your account has been restricted. Update your BVN here to avoid suspension." Bank impersonation keeps working not because scammers are technical geniuses, but because they have perfected the script: urgency, authority and a solution that requires you to act now, without thinking.

The good news: you do not need to tell a real call from a fake one on the spot. Nobody can, because the number on your screen can be faked and the scripts imitate real customer care staff well. What you need is a method that works without you having to decide. Here it is.

The method: you hang up, you call back

It works for calls and texts alike, and it has three steps:

1. Do nothing inside the incoming call or message. Do not give out details, do not tap links, do not press keys or dial codes, do not install anything and do not read out any code that arrives. If it is a call, say goodbye politely and hang up. Nothing bad happens if you hang up on your real bank: they will call again or you will sort it out another way.
2. Open the official channel yourself. Call your bank's number (the one on the back of your card or on its official website, typed in by you), use the bank's official app installed from the app store, or go to a branch. Never use the number that called you or the link they sent.
3. Check there. If there was a suspicious debit, a restricted account or something pending, it will show in your transactions or a real member of staff will confirm it. If nothing shows up, the message was fake.

That is all. The trick is understanding why it works: you choose the channel, so it no longer matters that they faked the number or copied the bank's website. Their deception lives inside the call or the text; the moment you step outside it, they have nothing.

The same method works for checking a message about tax, your NIN or a government grant and for the fake parcel SMS. Learn it once and it works for everything.

What your real bank will never ask you for

Memorise this list, because it is the quick test whenever you are in doubt:

• Your PIN, your full password, your token codes or your BVN "to update your records". Your bank may ask you to log in to ITS app or website; it will never ask you to read out your PIN or passwords over the phone or by text. If your records really need updating, you will find out by going to the app or a branch yourself.
• The OTPs that arrive by SMS. Those codes authorise transactions. Whoever asks for them over the phone is trying to get you to approve a transaction that THEY started. This is the central trap of almost all bank phone scams.
• That you install a remote-access app (AnyDesk, TeamViewer and the like) "to help you". No bank does that. It is the step before your account is emptied in front of your eyes.
• That you make a "test" transfer, or move your money "to a safe account". Transfers you make yourself are very hard to reverse. Your bank will never ask you to move money over the phone to protect it.
• That you act without hanging up. "Don't hang up, it's urgent, if you hang up the debit will go through." Haste is the scammer's tool. Your real bank would rather you check than obey quickly.

The most common variants and their script

• The debit you do not recognise. "There is a debit of ₦350,000 at an electronics shop. Do you recognise it?" You say no, and they guide you to "reverse" it: install something, give codes, make a transfer. Everything that happens after your "no" is the scam.
• The "account restricted" or "BVN update" text. A link to a site identical to your bank's, where you enter your username, password or card details. From then on, they are in control.
• The fake staff member who "protects" you. Friendly, professional, and already holding your basic details (name, account number, the last digits of your card: all of this circulates in data breaches). Professionalism verifies nothing; only the channel does.
• The disguised transfer. They ask you to approve something in your banking app or to dial a USSD code "to verify your identity", and what you are really doing is authorising a payment. Always read what you are approving before you confirm.

What to do if you already gave out details or codes

1. Call your bank immediately (the number on the back of your card) and explain what happened. Ask them to block your cards, stop any pending transactions and help you change your login details and PIN.
2. Watch your transactions over the following days, with debit alerts and app notifications turned on.
3. Report it to the police through the Nigeria Police Force's National Cybercrime Centre e-reporting portal (NPF-NCCC), with screenshots and the caller's number.
4. If your bank does not resolve your complaint, you can escalate it to the consumer protection department of the Central Bank of Nigeria (CBN).
5. Report the number in the spam numbers directory so it gets flagged.

Quick questions

Doesn't the number on the screen prove it is my bank? No. Caller ID can be faked (it is called spoofing), and scammers use it precisely with real bank numbers so that a quick search makes the call look genuine. That is why the rule is never to decide inside the call.

What if they already know my name, my account number and my balance? Personal details circulate in data breaches, and balances can be vaguely invented ("a large debit"). Knowing things about you does not make them your bank. Apply the method anyway.

Can I ask them for something to verify them myself? You can ask for the staff member's name and a reference number... and then hang up and call the bank yourself to check. Any "verification" that happens without hanging up verifies nothing.

Will my bank be upset if I hang up on them? No. Hang up without guilt and call back on the official number. That is exactly what their fraud team wants you to do.

Keep the rule in one sentence: if your bank contacts you, do nothing there; hang up, open the official channel yourself and check. Share it with the people around you: that one sentence can save a lot of money.