How to check whether a call or text from your bank is real

How to check whether a call or text from your bank is real

"We're calling from your bank's fraud team. We've detected a suspicious transaction and need to verify your identity." Or the text: "Your account will be locked. Verify your details here." Bank impersonation is one of phone scammers' favourite tricks, not because they're technical geniuses, but because they've perfected the script: urgency, authority and a solution that requires you to act now, without thinking.

The good news: you don't need to be able to tell a real call from a fake one on the spot. Nobody can, because the number on your screen can be faked and the scripts imitate real bank staff well. What you need is a method that works without you having to decide. Here it is.

The method: you hang up, you call back

It works for both calls and texts, and it has three steps:

1. Do nothing inside the call or message you received. Don't give out details, don't tap links, don't press keys, don't install anything and don't read out codes you receive. If it's a call, say goodbye politely and hang up. Nothing bad happens if you hang up on your real bank: they'll call again or you'll sort it out another way.
2. Open the official channel yourself. Call your bank on its own number (the one on the back of your card or on its official website, typed in by you), or open the bank's official app, installed from the app store. Never use the number that called you or the link they sent.
3. Check there. If there really is a suspicious charge, a locked account or something pending, it will show up in your transactions or a real staff member will confirm it. If nothing shows up, the message was fake.

That's it. The trick is understanding why it works: you choose the channel, so it doesn't matter that the scammer faked the number or cloned the bank's website. Their deception lives inside the call or the text; as soon as you step outside it, they've got nothing.

The same method works for checking a message from Inland Revenue or Work and Income, for fake "unpaid fine" texts and for fake parcel texts, all covered in our situation guides. Learn it once and it works for everything.

What your real bank will never ask you for

Memorise this list, because it's the quick test when you're unsure:

• Your PIN, your full password or your online banking login. Your real bank may ask you to identify yourself in ITS app or on ITS website; it will never ask you to read out your passwords over the phone or send them by text.
• The codes texted to you. Those codes authorise transactions. Anyone asking for them over the phone is trying to get you to approve a transaction THEY have started. This is the central trick in almost every bank phone scam.
• To install a remote-access app (AnyDesk, TeamViewer and the like) "so they can help you". No bank does that. It's the step before they empty your account in front of your eyes.
• To make a "test" transfer or one "to reverse the fraud". Transfers you make yourself are very hard to reverse. Your bank will never ask you to move money over the phone to protect it.
• To act without hanging up. "Don't hang up, it's urgent, if you hang up the payment will go through." Rushing you is the scammer's tool. Your real bank would rather you checked than obeyed quickly.

The most common variations and their scripts

• The charge you don't recognise. "There's an $800 charge at an electronics store. Do you recognise it?" You say no, and they guide you to "reverse" it: install something, read out codes, make a transfer. All the theatre after that "no" is the scam.
• The account locked by text. A link to a website identical to your bank's, where you enter your username and password. From then on, they're in control.
• The fake staff member who "protects" you. Friendly and professional, with your basic details (name, address, date of birth, the last digits of your card: all of that circulates after data breaches). Professionalism proves nothing; only the channel proves anything.
• The approval you didn't start. They ask you to approve something in your banking app or read out a code "to verify your identity", and it actually authorises a payment or adds their device to your account. Always read exactly what you're approving in the app.

What to do if you've already given out details or codes

1. Call your bank immediately (the number on the back of your card) and explain what happened. Ask them to block your cards, stop any pending transactions and change your login details. That's also the advice from Consumer Protection: call your bank straight away if you've handed over money or card details.
2. Check your transactions over the following days, with notifications turned on in the app.
3. Report it to NZ Police on 105 or through the 105 online service, and to the National Cyber Security Centre (NCSC), with screenshots and the number that called you.
4. Report the number in the spam numbers directory so it gets flagged.
5. If you're not happy with how your bank handles it, use its complaints process; after that, the Banking Ombudsman Scheme deals with unresolved complaints about banks.

Quick questions

Doesn't the number on my screen prove it's my bank? No. Caller ID can be faked (it's called spoofing), and scammers use it with real bank numbers precisely so that, if you look the number up, it seems legitimate. That's why the rule is never to decide inside the call.

What if they already know my name, my address and my balance? Personal details circulate after data breaches, and a balance can be vaguely made up ("a significant charge"). Knowing things about you doesn't make them your bank. Use the method anyway.

Can I ask them something to check them myself? You can ask for the staff member's name and a reference number... then hang up and call the bank yourself to check. Any "verification" that happens without hanging up verifies nothing.

Will my bank be annoyed if I hang up? No. Hang up with a clear conscience and call back on the official number. That's exactly what its security team wants you to do.

Keep the rule in one sentence: if your bank contacts you, do nothing there; hang up, open the official channel yourself and check. Share it with the people around you: it's the habit that saves people the most money.