Bank of America scam text

How to tell

In order. The first one holds even when the rest of the message looks completely real, which is the situation most people are actually in.

1. You are told to move your money to a new or "safe" account.

   No bank does this, because there is nothing to move it away from: if your account is compromised, the bank secures that account. Bank of America names this exact story in its alert and lists "Instructions to move money outside of your existing accounts or to purchase gift cards and/or crypto currency" as a red flag. This is the tell that still works when the caller is convincing, knows your details, and has been talking to you for twenty minutes.

2. Anyone asks you for a code that was texted to you, or for your PIN or password.

   The bank’s own line is that it "may ask you to confirm account activity, but we will never ask for your password, verification code, or for you to send money to us or anyone else in conjunction with that request." That distinction is the useful one. Being contacted about activity is normal. Being asked for the code is not, ever, and the code is what gets them into the account.

3. The message hands you a number to call, or the call seems to come from the bank itself.

   Bank of America tells you to verify by "Contact your bank using the number on your card or statement—never one provided in the message", and its alert says criminals "may spoof legitimate phone numbers, emails, texts or websites". So caller ID matching the bank is worth nothing as proof, and the only number that means anything is the one printed on your own card.

4. It is urgent, or you are asked to keep it confidential.

   Both are on the bank’s red flag list, and secrecy is there for one reason: the scam does not survive you describing it out loud to someone else. A real fraud case at a real bank is never harmed by you hanging up and calling back.

What Bank of America actually does

Hang up or put the phone down and check for yourself. Call the number printed on the back of your card or on your statement, or open the Bank of America app, or type bankofamerica.com into the address bar yourself and look at your own recent activity. Anything genuinely wrong with your account will still be there when you arrive by your own route.

Where to report it

Bank of America

Forward the text to abuse@bofa.com, which is the address its Security Center gives for emails and texts using the bank’s name. If you replied, called back, or gave anything away, call the number on your card or statement straight away.

Your mobile carrier

Forward the message to 7726, which spells SPAM on a keypad. It is free on every major carrier.

The Federal Trade Commission

Report it at ReportFraud.ftc.gov, which is the FTC’s own reporting site.