The Suspicious Login Scam

Flggd Scam School · Bank & Financial Institution Scams · Lesson 3 of 16

A text says someone just signed in to your bank account from a city you've never visited. Before you panic, here is how to tell a real suspicious login text from a fake.

The message looks like this

Why this is a scam

Nobody signed in anywhere. The scammer picked a random city, because almost any city will be one you're not in. The alarm is the product.

The "secure your account" link opens a copy of a bank login page. Typing your username and password there is the only breach that actually happens. Some versions then ask for the one-time code your real bank sends, which lets the scammer finish logging in as you.

Real login alerts live inside your banking app and your bank's own website. They don't route you through an unfamiliar address.

Red flags checklist

• The link isn't your bank's real web address.

• The alert names a location but no device, or details that feel generic.

• You're pushed to "secure" the account through the link, right now.

• The same alert doesn't appear in your banking app's notifications.

• After "logging in", you're asked for a texted code or card details.

The manipulation tactic

Fear of intrusion. The idea of a stranger inside your account makes the link feel like a lifeline instead of a trap.

What to do, and what not to do

• Don't tap the link.

• Open your banking app yourself and check your login history or alerts.

• If anything seems real, change your password from inside the app and call the number on the back of your card.

• Never enter a one-time code on a page a text sent you to.

• Forward the text to 7726 (SPAM), then delete it.

Not sure about a message you've received? Check it in seconds with the free Flggd app.