Fake Bank Product Recall Refund Scam
Criminals send fake notices claiming the victim's bank is processing a product recall refund to their account and needs account verification, then harvest banking credentials.
Part of: Fake Product Recall Refund Scams
Last reviewed: 8 June 2026
When a product recall involves a refund, the manufacturer typically processes it through the retailer or via cheque — not directly through a consumer's bank. Yet scammers send fraudulent texts and emails telling victims that their bank has received a recall-refund credit and just needs the account holder to log in to 'accept' the funds.
The bank branding makes the message particularly credible. Consumers trust their bank to handle money correctly, and a message that appears to come from their bank about an inbound payment triggers less scepticism than one from an unfamiliar brand. The 'accept the credit' action leads to a clone of the victim's bank's login page.
These campaigns are timed carefully to follow high-profile recall announcements for common household products — automotive components, baby formula, medical devices — so the recall itself feels plausible even to those who have not purchased the affected product.
How this scam works on the Your Bank brand
An SMS arrives: '[Bank Name]: A recall refund of $[amount] has been approved for your account. Please verify your details to receive the credit within 1-2 business days: [link].' The link leads to a near-perfect clone of the bank's online portal.
After the victim enters their username and password, they are asked for their full card number and PIN 'to confirm the destination account.' In some variants, a fake 'verification pending' screen follows, while the scammer uses the credentials to log in to the real account and initiate an outgoing transfer.
Phone variants have a recorded message play first — 'This is [Bank Name] automated services' — before connecting the victim to a live scammer. The live agent then requests online banking credentials for 'remote verification.'
Common red flags
- Your bank notifies you of an incoming recall refund that you never registered for.
- The link in the SMS goes to a domain other than your bank's official website.
- You are asked to enter your card PIN or full card number to 'accept' an incoming credit — banks do not require this.
- The bank message came via SMS with a link, rather than appearing as a notification in the bank's app.
- There is no corresponding pending credit in your bank account when you log in directly.
- The refund amount is identical for all messages in the campaign, not personalised to your actual purchases.
- The message asks you to act within a very short window — 'refund expires in 24 hours.'
How to protect yourself
- Check your bank account directly through the official app — any genuine incoming credit will appear there without you needing to take any action.
- Know that accepting an incoming bank credit requires no verification from you — it arrives automatically.
- Contact the product manufacturer directly to ask about recall refund processes — not your bank.
- Do not click SMS links claiming to be from your bank.
- Enable your bank's genuine SMS alerts so you know what real bank messages look like.
How to report it
- Report smishing to your mobile carrier by forwarding the message to 7726 (SPAM).
- Report to your bank's fraud team using the number on your card.
- Report to the FTC at reportfraud.ftc.gov.
- Report recall impersonation to the CPSC at cpsc.gov.
- File with ic3.gov if banking credentials were compromised.
Frequently asked questions
Does my bank ever need me to verify my details to receive an incoming payment?
No. Incoming credits are received automatically — there is no 'acceptance' step. Any message claiming otherwise is attempting to steal your credentials.
How would a genuine recall refund reach my bank account?
The manufacturer or retailer would issue the refund to the same payment method you used for the original purchase, or by cheque to your mailing address. Your bank plays no active role and would not contact you about it.
I clicked the link and logged in. What should I do?
Call your bank's fraud line immediately using the number on your card. Change your online banking password from a trusted device. Ask your bank to review recent activity and consider a temporary account freeze while they investigate.