How to check whether a call or SMS from your bank is real

How to check whether a call or SMS from your bank is real

"We're calling from your bank's fraud department. We've detected a suspicious transaction and need to verify your identity." Or the SMS: "Your account will be suspended. Verify your details here." Bank impersonation is one of the most effective phone scams, not because scammers are technical geniuses, but because they have perfected the script: urgency, authority and a solution that requires you to act now, without thinking.

The good news: you do not need to be able to tell a real call from a fake one on the spot. Nobody can, because the number on your screen can be faked and the scripts imitate real bank staff well. What you need is a method that works without you having to decide. Here it is.

The method: you hang up, you call back

It works for calls and SMS alike, and it has three steps:

1. Do nothing inside the incoming call or message. Do not give out details, do not tap links, do not press keys, do not install anything and do not read out any codes you receive. If it is a call, say goodbye politely and hang up. Nothing bad happens if you hang up on your real bank: they will call again, or you will sort it out through another channel.
2. Open the official channel yourself. Call your bank's number (the one on the back of your card or on its official website, typed in by you), or open the bank's official app, installed from the official app store. Never use the number that called you or the link that was sent to you.
3. Check there. If there really was a suspicious transaction, a frozen account or something pending, it will show up in your transactions, or a real bank officer will confirm it. If nothing shows up, the call or message was fake.

That is all. The trick is understanding why it works: you choose the channel, so it no longer matters to the scammer that they faked the number or cloned the bank's website. Their deception lives inside the call or the SMS; as soon as you step out of it, they are left with nothing.

The same method works for checking a message from IRAS or the CPF Board, for fake traffic-fine SMS and for fake parcel SMS (see our other guides). Learn it once and it works for everything.

What your real bank will never ask you for

Memorise this list; it is the quick test when in doubt:

• Your PIN, your full password or your Singpass details. Your real bank may ask you to identify yourself in ITS app or on ITS website; it will never ask you to read out your passwords over the phone or send them by SMS.
• The one-time passwords (OTPs) sent to you by SMS. Those codes authorise transactions. Whoever asks for them over the phone is trying to get you to authorise a transaction that THEY started. This is the central trap in almost all bank vishing.
• That you install an app "to help you", whether it is a remote-control app (AnyDesk, TeamViewer and the like) or an app from outside the official app stores. No bank does that. It is the step before they empty your account in front of your eyes.
• That you make a "test" transfer, or move your money to a "safe account". Transfers you make yourself are very hard to reverse. Your bank will never ask you to move money over the phone to protect it.
• That you act without hanging up. "Don't hang up, it's urgent, if you hang up the charge will go through." Haste is the scammer's tool. Your real bank would rather you verify than obey quickly.

The most common variants and their script

• The transaction you do not recognise. "There is a charge of S$800 at an electronics shop. Do you recognise it?" You say no, and they guide you to "reverse" it: install something, read out codes, make a transfer. All the theatre after your "no" is the scam.
• The account frozen by SMS. A link to a website identical to your bank's, where you enter your username and password. From that moment, they are in control.
• The fake officer who "protects" you. Friendly and professional, and already holding your basic details (your name, part of your NRIC number, the last digits of your card: all of that circulates in data breaches). Professionalism proves nothing; only the channel does.
• The call "transferred to the police". The fake bank officer says your account is linked to a crime and puts you through to a "police officer" or another "government official". As the IRAS scam advisory explains, government officials will never ask you over a phone call to transfer money, give your bank log-in details or install apps from unofficial app stores, and they will never transfer your call to the Police.
• The approval in disguise. They ask you to approve something on your phone "to verify your identity", and it is really a Singpass login, a transaction in your banking app or a PayNow transfer. Always read what you are approving, and never approve a Singpass login or a transaction you did not start yourself.

What to do if you have already given out details or codes

1. Call your bank immediately (on the number on the back of your card) and explain what happened, or use its emergency "kill switch" to freeze your accounts. Ask them to block your cards, stop pending transactions and reset your log-in details.
2. Check your transactions over the following days, with the app's notifications turned on.
3. Make a police report online through SPF e-services or at a Neighbourhood Police Centre, with screenshots and the caller's number. If you are unsure whether it was a scam, the ScamShield Helpline (1799) is available 24/7.
4. Report the number in the spam numbers directory so that it gets flagged.
5. ScamShield's I've been scammed page sets out the full process: contact your bank, make a police report, secure your accounts and report the scam to the platforms involved. If you end up in a dispute with your bank over the losses, FIDReC, the Financial Industry Disputes Resolution Centre, deals with disputes between consumers and financial institutions.

Quick questions

Doesn't the number on the screen prove that it is my bank? No. Caller ID can be faked (this is called spoofing), and scammers use it precisely with real bank numbers, so that looking the number up makes the call seem genuine. That is why the rule is never to decide inside the call.

What if they already know my name, my NRIC number and my balance? Personal details circulate in data breaches, and balances can be vaguely invented ("a significant transaction"). Knowing things about you does not make them your bank. Apply the method anyway.

Can I ask them for something so that I can check them myself? You can ask for the officer's name and a case number... and then hang up and call the bank yourself to check. Any "verification" that happens without hanging up verifies nothing.

Will my bank mind if I hang up on them? No. Hang up without guilt and call back on the official number. That is exactly what its fraud team wants you to do.

Keep the rule in one sentence: if your bank contacts you, do nothing there; hang up, open the official channel yourself and check. Share it with the people around you: it is the sentence that saves the most money.