Bank SMS scam
Fake bank text telling you to 'verify' a payment via a link.
How it works
You get an SMS that looks like it's from your bank, warning about a suspicious transaction. The link leads to a fake login page that captures your details, then a 'staff member' calls and tricks you into sharing the SMS code.
Common scenarios to watch for
This scam shows up in several different shapes. Recognise the pattern, not just one message.
The 'unusual login' alert
An SMS says a new device just logged into your bank from another state. A link offers to 'block' the device — it's a fake login page that captures your password and 2FA.
"ANZ: New device sign-in from Perth at 2:14am. If this wasn't you, block here: anz-blockdevice.com"
Red flags to spot
- Does the SMS contain a link asking you to log in?
- Is the URL not your bank's real domain (e.g. commbank.com.au, anz.com)?
- Did you get a follow-up call from someone asking for an SMS code?
- Are you being pressured to act immediately?
The fake fraud-team callback
After you tap the SMS link, a 'fraud officer' calls within minutes. They sound calm and professional, ask for the SMS code 'to confirm it's you' and then drain the account.
"Hi, this is Mark from NAB Fraud, reference #4471. I just sent you a 6-digit code — can you read it back to confirm we're speaking to the account holder?"
Red flags to spot
- Did the caller arrive within minutes of receiving the SMS?
- Are they asking for an OTP, password, or PIN?
- Did they call from a number you can't verify on the bank's website?
- Are they using urgency ('your account is exposed right now')?
The 'move to a safe account' trick
The caller insists your money is at risk and walks you through transferring it to a 'safe holding account' in your bank's name. The account belongs to a money mule.
"Your funds are exposed — please transfer the balance to safe-hold BSB 062-xxx now. We'll move it back once the investigation finishes."
Red flags to spot
- Are you being told to transfer money to a 'safe' or 'holding' account?
- Is the BSB/account not one you recognise as your own bank's?
- Did the person say the transfer is temporary and will be reversed?
- Are they staying on the line while you make the transfer?
Red flags
- 🚩Link in an SMS that asks you to log in
- 🚩Caller claiming to be 'fraud team' and asking for an OTP
- 🚩Pressure to move money to a 'safe account'
What to do
- 1Hang up and call your bank using the number on the back of your card.
- 2Never share an OTP or password — staff will never ask.
- 3Report to Scamwatch and forward the SMS to 7726.
Who's targeted
- Everyday banking customers with a mobile number on file.
- Older customers less familiar with SMS spoofing tricks.
Why it works
- The SMS lands in the same thread as real bank alerts, so it looks trusted.
- Fear of fraud overrides the instinct to verify before clicking.
Common variations
Different shapes of the same scam — recognise the pattern.
- 1'Suspicious payment' alert with a cancel link.
- 2'New payee added' SMS asking you to confirm or block.
- 3Follow-up phone call from the 'fraud team' walking you through transfers.
If you've already been scammed
- 1Call your bank's official fraud line within minutes — speed decides recovery.
- 2Freeze cards and change online banking password and 2FA from a clean device.
- 3Report to Scamwatch and forward the SMS to 7726.
Frequently asked
Will my bank ever text me a login link?▾
No major bank sends login links by SMS. Always open the bank app directly.
Is it safe to reply STOP?▾
Don't reply at all — it confirms your number is active. Just forward to 7726 and delete.
I clicked the link but didn't log in. Am I safe?▾
Likely yes, but run a malware scan and watch your account for 30 days.
Related scams
Connected patterns you should also learn — ranked by how much they overlap with this one.
Romance scam
An online relationship that turns into requests for money.
Read guideParcel delivery scam
Fake AusPost or courier SMS asking for a small 'redelivery fee'.
Read guideFake government messages
myGov, Medicare, Centrelink lookalikes asking you to 'verify'.
Read guideTech support scam
Pop-ups or calls claiming your computer is infected, asking for remote access.
Read guideFake charity scam
Fake fundraisers that exploit disasters and emotional causes.
Read guideRecovery (refund) scam
Scammers targeting people who've already been scammed once.
Read guide