Fake bank alert asking for your verification code
Scammers trigger a real one-time code from your bank, then text you pretending to be the bank so you read it back to them. With it, they can take over your account.
How this scam works
The scammer starts a real sign-in or password-reset attempt, which makes your bank send a genuine code. The fake bank message then tries to get that code from you so the scammer can finish the takeover.
Common versions of the message
- An unusual-sign-in alert
- An account-lock deadline
- A request to reply with a one-time code
What the message looks like
Text from Chase Alerts
Chase Security: Unusual sign-in detected. Your account will be locked within 2 hours. Verify at https://chase-secure-verify.top/login and reply with the verification code we just sent.
Fictional example based on common, publicly reported scam patterns.
The red flags
- 1
Threat + deadline: “locked within 2 hours”
Fear makes you skip the checks
The lockout deadline uses fear to make you respond before checking your bank app or calling the number on your card.
- 2
Suspicious link: “chase-secure-verify.top”
Real bank sites never end in .top
The example uses a bank name in a .top address. A familiar name inside a link is not proof that the bank owns it.
- 3
Asks for your code: “reply with the verification code”
That code unlocks your account. Never share it.
A verification code authorizes access. Someone asking you to send it back is asking for the key to your account.
What to do
- Never share a verification code with anyone who contacts you.
- Call the number on the back of your card to check your account.
- If you already shared a code, call your bank right away and change your password.
If you already replied, clicked, or paid
- Call the number on the back of your card immediately and say that a verification code may have been exposed.
- Change your bank password from the bank's app or a web address you type yourself.
- Review recent account activity with the bank and follow its steps for securing the account.
Got a message like this?
Paste it into TrustShield's free checker to see the warning signs in seconds. No sign-up needed to try it.