This one unsettles people because it looks so convincing. The text arrives showing your bank's name as the sender, and on many phones it drops neatly into the same conversation as the genuine messages you have had before. There is no odd number to spot, no obvious misspelling. That is because sender names on texts can be faked, and the fraudsters know exactly which banks to impersonate.

The message itself is the giveaway, once you know the shape of it. It says there is suspicious activity, that your account is at risk, and that you must act now - tap this link, call this number, or confirm a code that has just been sent to you. The urgency is the product. A real fraud team gives you time and never needs you to move money or read out a code to make yourself safe.

The most dangerous version does not ask for anything by text at all. It just tells you the fraud team will call, and then the phone rings. Because you were half-expecting it, the call feels legitimate, and the person on the line walks you through “securing” your money by moving it to a new account. That account is theirs. No bank will ever ask you to do this, however calm and helpful the caller sounds.

The rule that beats all of it is simple and worth saying out loud to yourself: ring back on the number printed on your card. Not the number in the text, not the number the caller gives you, not the one that shows on your screen. Hang up, wait a moment so the line properly clears, and dial the card number yourself. If the alert was real, you will reach the right people. If it was not, you have lost nothing.