Fake Bank Stimulus Payment Notification Scam
Fraudsters send texts or emails mimicking a victim's own bank, claiming a government stimulus or relief payment has been deposited and can be accessed by clicking a link — a phishing attack that harvests banking credentials under the cover of a benefit.
Part of: Fake Stimulus Payment Scams
Last reviewed: 7 June 2026
During periods of government stimulus activity, scammers rapidly deploy bank-impersonation campaigns that mirror genuine payment notifications. By combining the trusted name of the victim's bank with the financial appeal of a stimulus payment, these campaigns achieve a high click-through rate because both the sender and the subject seem credible.
The fake message typically states that a specific dollar amount — chosen to seem plausible — has been deposited to the account by the government and is ready to be claimed. The 'Claim Your Payment' or 'Access Funds' link leads to a convincing replica of the bank's online login page. Once credentials are entered, the attacker logs in to the real account and may find either an existing balance to drain or, in some campaigns, an actual stimulus deposit that has arrived.
This attack exploits the fact that real government stimulus payments are distributed via direct deposit to bank accounts — a legitimate, expected process that the fake notification closely mirrors.
How this scam works on the Your Bank brand
Real government stimulus deposits appear automatically in your bank account balance with no action required. Your bank may notify you via the app that a deposit has been received, but it never asks you to click an external link to 'claim' or 'unlock' a payment — the money is already in your account.
Fake notifications arrive by SMS (often appearing in the same thread as your bank's real messages due to sender-name spoofing), by email, or through social media. They may reference the correct bank name and the last four digits of your account number, both of which can be obtained from prior data breaches.
Some campaigns run variations for multiple banks simultaneously — the same message swapping only the bank name — targeting the statistical likelihood that a given recipient has an account with one of the major institutions referenced. The goal is credential harvest: the attacker logs in with the captured credentials and transfers the balance or changes the account's linked payment details.
Common red flags
- A text or email from your bank saying a stimulus or relief payment requires you to click a link to access it
- Sender address or SMS number does not match your bank's registered contact details
- The 'claim' or 'access' link goes to a domain other than your bank's official website
- Login page appears after clicking the link — real payments are already in your account without a login requirement
- The amount mentioned is oddly specific or does not match the stimulus programme you are aware of
- Urgency: 'Funds expire in 72 hours if not claimed'
- Your bank app shows no corresponding notification when you log in independently
How to protect yourself
- Log in to your bank app directly to check your balance — a real deposit will be there without any action
- Check the IRS Economic Impact Payment tracker at irs.gov or your government's official payment portal
- Never enter banking credentials on a page reached from an SMS or email link
- Sign up for your bank's genuine push notifications through the official app
- Report the suspicious message to your bank's fraud team using the number on the back of your card
- Forward smishing texts to 7726 (SPAM) in the US and UK
- Be especially vigilant during periods when government stimulus payments are widely reported in the news
How to report it
- Call your bank's fraud line using the number on the back of your card
- Report to the FTC at reportfraud.ftc.gov — this is a primary FTC enforcement area
- Forward suspicious texts to 7726 (SPAM)
- Report IRS-impersonation elements to [email protected]
- File a complaint with the CFPB at consumerfinance.gov/complaint if your bank does not respond
Frequently asked questions
Do banks require customers to 'claim' deposited stimulus payments?
No. Stimulus deposits from the government go directly into your account and appear in your balance automatically. No action is required to claim them. Any message saying you must click a link to access a deposit is a scam.
How do I check whether a real stimulus payment has been deposited?
Log in to your bank's official app and review your transaction history. You can also check your payment status through official government resources such as irs.gov for US taxpayers.
Can I spot a spoofed bank SMS before clicking anything?
Look at the full sender number rather than just the display name. If the message comes from a random mobile number rather than a recognised shortcode, be suspicious. When in doubt, never click — log in independently and call the bank's official fraud line.