Is a bank text asking me to confirm a payment I didn't make a scam?

Scammers send texts that mimic your bank's genuine fraud-alert format. The message claims an unusual payment has been made and asks you to press a key, click a link, or call a number to confirm or cancel it. If you interact, you may be connected to a fake 'fraud team' that guides you into handing over your one-time passcode, or the link installs credential-harvesting malware. Genuine bank fraud alerts do exist, but they will never ask you to share a full password, PIN, or one-time code, and they will direct you to the number on the back of your card — not a number embedded in the text. The safest response is to ignore the text entirely and log in directly through your bank's official app or website to check for any real alerts.

The fake alert is usually stage one of a two-act play. The text softens you up with alarm; the follow-up call — from the 'fraud team', often on a spoofed number — does the extraction, walking you through 'securing' your account in ways that actually drain it: moving money to a 'safe account', reading out one-time passcodes, or approving transactions in your app 'to cancel them'. Each of those actions is something only a fraudster would ever request, and knowing that list cold is worth more than any ability to judge whether a message looks authentic.

A fixed personal procedure removes the guesswork under pressure: never act through the message, always check the app, and if a caller follows up, hang up and dial the number on your card yourself. Banks design their genuine fraud processes to survive exactly this behaviour — a real fraud team loses nothing when you hang up and call back, because the alert will be waiting on your account. Only the scam depends on keeping you inside the channel it chose.