A text from your bank's real number can still be a scam
Almost every piece of scam advice tells you the same thing: check the sender. It is well meant, and it is quietly wrong — because the one thing a scammer can fake most easily is the sender.
Australia's own consumer regulator says it plainly: scammers can make a call appear to come from a bank's legitimate phone number, or send a text that lands in the same conversation thread as genuine bank messages. The technique is called spoofing, and it means the name at the top of the message and the number it seems to come from can both be copied. When a fake text drops into the same thread as last month's real ones, there is nothing on the screen to tell them apart.
Everything about that message is designed to pass the checks people are told to run. The sender says CommBank. It may sit in the same thread as real CommBank alerts. The number looks like a bank number. And the moment you ring it, a calm, professional voice walks you through "securing" your account — which means moving your money to an account the scammer controls.
Why the number can't be trusted
Two things are true at once, and together they close the trap:
- The sender can be spoofed. The name and number shown at the top of a text are just a label. Scammers overwrite them so a message appears to come from a trusted source — and can thread it in with real messages you have kept.
- The callback number is inside the scammer's own message. Even where sender names are now checked, a phone number typed into the body of a text is not verified by anyone. The scammer chose it. Calling it calls them.
This is why "does the number match?" is the wrong question. A number that matches proves only that the scammer copied it correctly.
What a real bank will never do
Because the sender can't be trusted, the safe test is what the message asks. Your bank will never:
- Ask you to move money to a "safe account" — this phrase is itself the scam.
- Ask for your full password, PIN, or a one-time security code.
- Send you a link to log in, or a number to call to "verify" or "reverse" something.
If a message asks for any of those, it is a scam — regardless of the name at the top, the number it came from, or the thread it sits in.
What to do instead
Don't reply, don't tap the link, and above all don't call the number in the message. Find your bank's number yourself — it is on the back of your bank card and inside their official app — and call that. If there really is a problem with your account, the bank will find it when you ring the number you trust.
Then delete the message and block the sender: tap the sender's name at the top, then Block this Caller.
If you already called or paid
Act quickly, and don't be embarrassed — these scripts are written by professionals to catch careful, capable people. Call your bank straight away, on the number from your card, and ask them to stop the payment and watch the account. Then call IDCARE on 1800 595 160, Australia's free national identity and cyber support service, and report it to Scamwatch. You are not in trouble, and you are far from alone.
Common questions
If a text comes from my bank's real number, is it safe?
Not necessarily. Scammers can spoof both the sender name and the phone number, so a fraudulent text can appear inside the same conversation thread as genuine bank messages. The number you see is not proof of who sent it. Judge the message by what it asks you to do, never by the number it appears to come from.
The message told me to call a number. Should I use it?
No. Never call a phone number that a message gives you, even if it looks like your bank's real number. Find the number yourself, on the back of your bank card or in the bank's official app, and call that instead. A number printed inside a message can be part of the scam.
Does the new Unverified label mean I am safe now?
It helps, but it does not close the gap. From 1 July 2026 unregistered sender names may be labelled Unverified. But scammers still spoof registered names to appear in genuine threads, and a callback number written inside a message is not covered by the register at all. Treat the content of the message as the real test.
How can I tell a real bank message from a fake one?
Ask what it wants, not who it is from. Your bank will never ask you to move money to a safe account, never ask for a full password or one-time code, and never send a link to log in. If a message asks for any of those, it is a scam no matter how genuine the sender looks.
How can my parent check a suspicious bank text without calling me?
They can forward it to a scam-checking service like Is it a scam?, which reads the message and replies in seconds with a plain-English verdict. Because forwarding a text is a habit they already have, there is nothing new to learn and no app to install.
Not sure about a message right now?
Is it a scam? gives your parents a calm second opinion on any worrying text, email or phone call — in seconds, on the phone they already use. No app for them to install, nothing new to learn.
See how it works