Is this text from my bank real — or a scam?

The mistake: clicking the link "just to check"

It feels responsible — I'll just look at the page and see if it's legit. But the page is the trap. Phishing sites are pixel-copies of real bank logins, and the moment you type your username and password "to check," they have them. The scam doesn't need you convinced; it needs you curious.

The other tell you can't rely on: the message knowing your bank's name. Scammers blast the same text for every major bank — send "Chase" to a million people and a few hundred thousand of them bank with Chase. It's not knowledge, it's arithmetic.

The check that actually works

The sender can write anything in the message. What they can't dress up is the number they sent it from:

• Real bank texts come from short codes (5–6 digit numbers) or established, registered business lines your bank uses consistently — the same thread your last real alert arrived in.
• Scam texts overwhelmingly come from ordinary 10-digit numbers — and when you look those up, the pattern is familiar: an internet (VoIP) line, often newly active, often already reported for phishing.

A ten-second lookup of the sending number tells you which story you're in — before you've touched anything. And because the number is the part of the message the scammer can't fake convincingly (names are free to fake; carrier data isn't), it's the honest signal in a dishonest message.

If it's real, nothing is lost

Here's the asymmetry that makes this easy: if the alert is genuine, it will still be genuine five minutes from now inside your banking app. Banks never require you to act through the text itself. The only party that loses when you verify independently is the scammer.