The text looks like it came from us. That is the whole trick.
A phishing scam is not a hacker breaking into your account. It is a conversation designed to get you to open the door yourself: a text, an email, or a phone call from someone pretending to be your bank, walking you toward handing over a passcode, a card number, or a payment you approve with your own hands. The Federal Trade Commission reports that people lost $3.5 billion to imposter scams in 2025, the most reported type of fraud last year, with losses nearly tripling since 2020.
The good news: these scams run on a script, the script has tells, and one simple habit defeats nearly all of it. Here is how to spot a phishing scam before it costs you anything.
What we will never ask you to do
Start with the four words at the center of the American Bankers Association campaign this post takes its name from: banks never ask that. When a message or caller asks for something your bank would never ask for, you do not need to figure out whether the rest is real.
A Security Bank employee will never contact you and:
- Ask for your full password, passcode, or PIN. Not to verify your identity, not for any reason.
- Ask you to read back a one-time code. Those codes exist to stop the person on the phone, not to be handed to them.
- Ask for your full card number. We issued the card. We already have it.
- Ask you to move money to a "safe" account. There is no such procedure at any bank. That request is the scam itself.
- Ask you to pay or "verify" anything with gift cards, cryptocurrency, or a payment app.
- Pressure you to act before you have time to verify. A real banker will always give you room to hang up and call back.
A genuine fraud alert from us may ask one thing: whether a transaction is yours, yes or no. It will not ask you to click a link and sign in, read back a code, or send money anywhere.
The five red flags in any message
The ABA's Banks Never Ask That campaign boils scam recognition down to five red flags. Any one of them is reason enough to stop:
- They ask you to open a link. A real bank alert does not need you to sign in through a link it sent you.
- They ask you to keep it a secret. Fraud prevention never requires secrecy. Isolation is a scammer's tool, and it is how family members get cut out of the moment they would have said "that sounds off."
- They send an attachment you were not expecting. Unexpected attachments carry malware. Banks do not send them.
- They ask for personal information like PINs, passwords, or Social Security numbers.
- They pressure you to log in or send money through a payment app. Urgency is the engine of every one of these scams.
The same tells apply well beyond fake bank messages. The government-impostor version runs on the identical script, which is why our post on student loan forgiveness scams reads like a cousin of this one.
How it actually plays out: the text, the email, the call
The text message
Start with what makes this one tricky: card fraud alerts by text are real. We use them on our own debit cards, and a legitimate alert asks exactly one thing, whether a transaction is yours, yes or no. Then it stops. A yes or no gives a scammer nothing, which is why the scam version cannot stop there.
The fake alert imitates that first text and then escalates. You reply, and minutes later your phone rings: a calm, professional voice from the "fraud department" offers to help reverse the charge. There was never a charge. The follow-up is the scam, and the helpful voice will walk you through "verifying your identity" with a one-time code, which is actually the code that lets them into your online banking, or through "reversing" the charge, which is actually you sending money out. So judge the conversation, not the first message. The moment anything after that yes or no asks you to click a link, share a code, or move money, you are done talking. Hang up and call us.
The email
The email version leans on look-alikes: a sender address one letter off from the real one, a logo lifted from the real site, and a link to a sign-in page that is a pixel-perfect copy of your bank's. Whatever you type on that page goes straight to the scammer. The unexpected attachment version skips the fake page entirely and puts malware on your device the moment you open the file.
The phone call
This is the one that catches careful people, because caller ID can be spoofed to display your bank's real name and number, and the caller may already know your name, your town, and the last four digits of your card from some unrelated data breach. Knowing things about you is not proof of being your bank. It is the cheapest costume there is. When a caller who already "verified" themselves this way then asks for a code, a passcode, or a transfer, you are on the phone with a scammer, in Waconia or anywhere else.
One habit beats every script: hang up and call us yourself
You do not have to out-argue a professional manipulator, and you do not have to decide in the moment whether a message is real. Break the channel. Hang up, do not reply, do not click. Then contact the bank through a channel you already trust: the number on the back of your card, the phone number on our contact page, or the lobby of your local branch.
If the alert was real, we will know about it when you call, and nothing is lost. If it was not, you just ended the scam in under ten seconds. No real Security Bank employee will ever be offended that you hung up and called the bank directly. We teach people to do exactly that.
If you already clicked, replied, or shared something
It happens to sharp people every day, and speed matters far more than embarrassment. In the first hour:
- Call us at 320-864-3171. The sooner we know, the more options we have with cards, passcodes, and pending transactions.
- Turn off your debit card in the app. The My Cards feature in our mobile app shuts the card off instantly while you sort things out.
- Change your online banking passcode, and change it anywhere else you used the same one.
- Report it at ReportFraud.ftc.gov, and if personal information like a Social Security number was exposed, follow the recovery plan at IdentityTheft.gov.
Our fraud prevention and security center keeps the full playbook: current trending scams, the warning signs, credit freeze contacts for all three bureaus, and what to do next for each situation.
Make your phone the strong link
The same phone that receives phishing texts can be set up to shrink what a scammer could ever get. Our online and mobile banking tools were built for exactly this:
- Transaction alerts. Set alerts on your accounts and your debit card, and you will usually know about a bad charge before any scammer could "warn" you about it.
- Card controls. My Cards lets you turn your debit card off and on, set location controls, and report a card lost or stolen from your couch.
- Biometric sign-in. Face or fingerprint sign-in means your passcode gets typed less often, and a passcode you rarely type is a passcode that is harder to phish.
- Digital wallet. Paying by phone shares a one-time token instead of your real card number. Our digital wallet guide covers how to set it up through My Cards.
Frequently asked questions about phishing and bank impostor scams
How can I tell if a text from my bank is real?
You cannot tell from the sender, because numbers can be spoofed, so judge the request instead. Real card fraud alerts by text exist, and they ask one thing only: whether a transaction is yours, yes or no. Answering that costs you nothing. Any text that goes further, asking you to click a link, sign in, share a code, or reply with personal information, should be treated as a scam. When in doubt, do not reply at all; contact the bank at a number you already have, such as the one on the back of your card.
Will Security Bank ever call and ask for a one-time code or my passcode?
No. A Security Bank employee will not contact you and ask for your passcode, a one-time code, or your full card number. A genuine fraud alert may ask whether a transaction is yours, but it will never ask you to share credentials, click a sign-in link, or move money. If a caller asks for any of those, hang up and call us at 320-864-3171.
What information will a bank never ask for over the phone?
Your full password or passcode, your PIN, a one-time security code, or your full card number. A bank will also never ask you to move money to a so-called safe account or to pay anything with gift cards, cryptocurrency, or a payment app. Those requests identify the caller as a scammer regardless of what your caller ID says.
What is a one-time passcode scam?
A scammer tries to sign in to your online banking, which triggers a real security code sent to your phone. They then call or text you pretending to be the bank and ask you to read the code back "to verify your identity." The code is real, the caller is not, and reading it back completes their sign-in. Never share a security code with anyone, including someone claiming to work at the bank.
What should I do if I clicked a link in a fake bank text?
If you clicked but entered nothing, close the page and delete the message. If you entered a passcode, card number, or any personal information, call us at 320-864-3171 right away, change your online banking passcode, and turn your debit card off in the My Cards section of the mobile app while we help you sort it out. Then report the scam at ReportFraud.ftc.gov.
Why do scammers ask for gift cards or payment app transfers?
Because those payments move instantly and are hard to reverse or trace. That is also why the request is such a reliable tell. No bank, government agency, or legitimate business collects payments or "verifies" anything through gift cards or cryptocurrency.
Someone has my card number. What should I do?
Turn the card off in My Cards, then call us so we can replace it and review recent transactions with you. A card number alone has limited value once the card is off, which is why it helps to have the app set up before anything ever goes wrong.
Suspicious message on your screen right now?
Do not answer it. Call us at 320-864-3171, or walk into your nearest branch and hand the phone to a banker who knows you. That is what we are here for, from Glencoe and Winsted to Waconia, Cambridge, and Minnetonka. Find yours on our locations page, and share this post with the people you look out for. Scammers count on nobody talking about it. Neighbors talking to neighbors is how these scams die.
