How to Spot Fake Bank SMS Messages: A Guide for Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Bank SMS Messages: A Guide for Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

SMS phishing, also known as "smishing," is a growing threat to Australian small businesses. Scammers send fraudulent text messages pretending to be from your bank in an attempt to steal your login credentials, credit card details, or business funds. Because these messages often appear in the same thread as legitimate bank alerts, they can be difficult to spot at a glance.

Common Red Flags in Fake Bank SMS Messages

Before clicking any link or replying to a text, check for these warning signs:

• Urgent language: Messages claiming your account is locked, suspended, or at risk of immediate closure.
• Unexpected links: Shortened URLs or web addresses that do not match your bank's official domain.
• Requests for personal information: Asking for your password, PIN, OTP (one-time passcode), or CVV via text.
• Generic greetings: Using "Dear Customer" instead of your name or business name.
• Poor spelling or grammar: Unusual phrasing or errors that a professional organisation would not send.
• Unsolicited payment alerts: Notifications for transactions you did not make, designed to trigger a panic response.

How to Verify a Bank SMS

1. Do not click any links or reply to the message.
2. Open your bank's official mobile app or type the bank's web address directly into your browser.
3. Log in using your usual credentials and check your account activity and secure message centre.
4. If the alert is legitimate, it will also appear in your online banking portal.
5. If you cannot verify the message, contact your bank using the phone number on the back of your card or on their official website.

Never provide your OTP, password, or PIN to anyone, even if they claim to be from your bank's fraud department. Banks will never ask for these details via SMS.

What to Do If You Clicked a Suspicious Link

1. Disconnect your device from the internet if you entered any banking details.
2. Log into your online banking from a different, trusted device and change your password immediately.
3. Contact your bank's fraud department to report the incident and request a hold on affected accounts.
4. Check your business accounts for unauthorised transactions.
5. Report the scam to Scamwatch via the Australian Competition and Consumer Commission website.

If you believe your business banking credentials have been compromised, treat it as a critical security incident. Notify your internal IT team or MSP immediately so they can analyse affected devices for malware.

Protecting Your Business from SMS Scams

• Enable multi-factor authentication (MFA) on all business banking accounts.
• Keep your mobile operating system and banking apps updated.
• Train employees to recognise smishing attempts and report suspicious messages.
• Save your bank's official contact details in your phone so you can verify communications quickly.

Still Having Issues?