That Fraud Alert Text Might Be the Fraud

You definitely did not.

So you reply NO.

A few seconds later, your phone rings. The caller says they’re with the fraud department. They know your name, and they mention the suspicious charge. They sound calm, professional and ready to fix the problem. 

This is where a fake fraud alert can become very expensive.

Messages like these work because they imitate something your financial institution might legitimately do: warn you about suspicious activity. The scammer doesn’t need you to be careless. They need you to be concerned enough to react before you verify who you’re talking to.

And people are losing real money this way. The Federal Trade Commission says consumers reported $3.5 billion in losses to impersonation scams in 2025. Bank impersonators accounted for the highest reported losses among business impersonation scams, at nearly $1 billion.

A fake fraud alert may mention a purchase you don’t recognize, an account that has supposedly been locked or suspicious activity that needs “immediate attention.”

The message might ask you to reply, click a link or call a number.

That first step often isn’t where the scam happens. It’s how the scammer gets you into the conversation.

The FTC says fake bank fraud alerts are among the most commonly reported text scams. In 2024 alone, consumers reported $470 million in losses from scams that started by text.

Once you respond, the story can get much more convincing.

The “fraud representative” may say someone has access to your account. They may claim another transaction is about to go through. They might tell you they need to verify your identity or secure your money before it disappears.

Now there’s a clock running.

Except there isn’t.

The urgency is part of the scam.

Eventually, the person trying to “help” needs something from you.

Maybe it’s a verification code that just arrived on your phone. Or they want your online banking credentials. Maybe they tell you to send money through a payment app, wire transfer or cryptocurrency.

One particularly dangerous version involves telling victims that their account has been compromised and their money needs to be transferred into a “safe” or “protected” account.

There is no safe account.

The FTC is very direct on this point: anyone who unexpectedly tells you to move money in order to protect it is trying to scam you. The same goes for someone asking you to share a verification code sent to your phone.

That code is not there so you can prove your identity to a caller. It may be the very thing standing between the scammer and your account.

That doesn’t mean the caller was.

Scammers can spoof caller ID information so a call appears to come from a financial institution, government agency or other organization you recognize. A familiar name appearing on your screen is no longer enough to prove who is actually calling. Hughes has previously warned members about scammers making calls appear to come from Hughes itself.

The same mindset applies to links.

A fake site can copy logos, colors and language from a real organization. The address may even look convincing at a glance.

Instead of trying to decide whether a suspicious message looks real, take the message out of the equation entirely.

If you get an unexpected fraud alert, don't use the link, phone number or instructions in the message.

Open the Hughes mobile app yourself or type HughesFCU.org into your browser. Check your recent account activity there.

If you see a card transaction you don’t recognize, Hughes members can use myCards inside Digital Banking to turn a debit or credit card off while they investigate. Members can also customize card alerts, including notifications for transactions.

Then contact Hughes using a number you already know is legitimate. The Hughes Member Contact Center can be reached at 520-794-8341.

This one habit solves a lot of the problem: don’t let the person who contacted you choose how you verify them.

If the warning is legitimate, you can still deal with it through the real organization.

If it isn’t, you’ve just ended the scam.

Fake fraud alerts can look different, but the pressure usually starts heading in the same direction.

Be suspicious if someone who contacted you unexpectedly wants you to share a security or verification code, provide online banking credentials, transfer money somewhere else, buy gift cards or cryptocurrency, install software on your device, or stay on the phone while you move money.

Also pay attention to secrecy.

A scammer may tell you not to speak with anyone else because the investigation is “confidential.” They may claim employees at your financial institution are involved in the fraud. Some even tell victims what to say if a bank employee asks why they’re moving a large amount of money.

That isn’t added drama. It’s an attempt to separate you from the people most likely to stop the transaction. The FTC specifically warns that instructions to conceal the real reason for a withdrawal or transfer are a sign of a scam.

Don’t assume it’s too late.

If all you did was reply to the message, stop the conversation. Don’t click anything else, and don’t answer follow-up calls from numbers provided in the text.

If you clicked a link or shared account information, passwords, security codes or financial information, contact Hughes directly as soon as possible.

Review your recent transactions. If a card may be compromised, turn it off through myCards while you contact Hughes.

If you sent money, tell Hughes exactly what happened. Speed matters.

You can also report scam texts using the “Report Junk” or similar feature on your phone, forward the message to 7726 (SPAM) and report the scam to the FTC at ReportFraud.ftc.gov.

The frustrating thing about these scams is that real fraud alerts exist. Financial institutions really do monitor accounts. Suspicious transactions really do happen. Scammers know that.

They’re borrowing the language of security to get around your own. So when a text makes your stomach drop, resist the urge to solve the problem inside the text thread.

Close it.

Open the app or website you already trust.

Check the account yourself.

Then contact Hughes directly if something doesn’t look right.

The extra minute it takes to verify could be the most important part of the transaction.