How to detect, protect yourself from and respond to fraud

An unexpected text message, email or phone call is likely a fraud attempt if it pressures you to act quickly or asks for sensitive data like passwords, account numbers or one-time passcodes. Legitimate organizations, including your bank, will never contact you out of the blue to request this private information. If a message contains spelling errors or links to an unfamiliar website, or a caller demands immediate action, pause before you act. Hang up or delete the message, then contact the company directly through a verified channel you trust.

More and more, we rely on digital tools, mobile apps and online accounts to manage our daily lives. But that convenience doesn't come without risk. Cyber fraudsters are constantly looking for ways to gain access to account numbers, login credentials and personal data.

Fraud attempts are so common that, according to Citizens Cybersecurity & Fraud Survey*, 50% of respondents report experiencing an online fraud or scam attempt. These fraud attempts typically come via a phone call, email or text, with scammers often posing as a bank employee, service provider or company you trust.

"Several factors are driving a shift in digital fraud. The move to electronic payments, including the U.S. Treasury's transition away from issuing most paper checks, has reduced opportunities for check fraud – but it's led fraudsters to the path of least resistance, gravitating toward digital channels that allow them to work more quickly, anonymously and remotely. Staying vigilant is more important than ever," says Jen Martin, Head of Fraud and Claims at Citizens.

How can you tell if it's a legitimate message or from a bad actor? Learn the signs of fraudulent activity, how to protect yourself and how to respond when you're targeted.

Know the warning signs of fraud

Whether a message lands in your inbox, shows up on your feed or comes through a phone call, learning to spot a few universal warning signs is your best defense against digital theft.

Requests for personal information

Fraudsters are constantly on the hunt for data that can help them break into your online and mobile accounts. They often try to trick you into sharing this information by impersonating a business you work with or an organization you know.

Receiving an unprompted request for highly sensitive data like your Social Security number or full bank account number is an immediate red flag. Legitimate companies do not ask you to send this information over text or email.

If you didn't initiate the contact, don't share the data. If an unexpected message or caller asks you for any of these credentials, do not respond. Instead, contact the company directly through a verified channel, such as the phone number listed on your monthly statement or the back of your card.

Unsafe links and fake websites

Unsafe links are typically embedded in urgent text messages, unexpected emails or direct messages on social media. They're designed to look completely routine, like a link to track a delayed package, unlock a restricted account or view a routine invoice.

The link will often direct you to a fake website that looks exactly like a legitimate login screen, where you're asked to enter your credentials, or it may secretly download malicious software onto your device.

To protect your data, follow these steps before interacting with any link:

• On a computer desktop: Hover your mouse cursor over the link without clicking it. A small text box will pop up, either right next to your cursor or in the bottom-left corner of your browser window, revealing the actual destination URL.
• On a smartphone or tablet: Don't tap the link normally. Instead, firmly press and hold the link for a second. A preview box will appear on your screen showing you the true web address before you choose to open it.

Once you can see the true web address, look closely at the domain name. Scammers frequently register addresses that look almost identical to real companies, hoping you won't notice character swaps, subtle misspellings or wrong domain endings like .info or .biz instead of .gov or .com.

If the previewed address looks unfamiliar or slightly "off," don't tap or click it. Delete the message immediately. If the message claims to be from an organization you do business with, log in to your account through the official app or a separate browser window to check for alerts and report the suspicious message to the company's fraud department.

Suspicious emails and texts

Digital messages are often designed to catch you on the go when you're more likely to react quickly. A common tactic is a fake alert via text or email claiming that an urgent balance needs to be paid or that an account is about to be locked.

If a message creates a sudden sense of urgency, take a breath and verify the claim independently. Instead of relying on the text or contact information provided in the message, log directly into your official online account or mobile app to check your actual balance and alerts. If the message doesn't match what you see on your dashboard, delete it.

If you ever question the legitimacy of a message claiming to be from Citizens, don't reply or click any links. Instead, report it by contacting us through the mobile app or the phone number located on the back of your card.

One way to recognize legitimate Citizens text messages is by becoming familiar with the short codes we use. Citizens commonly sends text messages from:

• 63776 – General messages
• 76191 – Account setup messages (including auto loans, credit cards, deposits, student lending, HELOC and Citizens Pay)
• 79669 – Account alerts, payment reminders and Citizens Access messages

If you receive a message claiming to be from Citizens that comes from an unfamiliar number, asks for sensitive information or creates pressure to act immediately, pause and verify the request through the Citizens mobile app¹ or a trusted phone number.

Voice verification scams

Fraud signs don't just appear in text messages or emails; they frequently happen over the phone. Scammers rely heavily on Voice over Internet Protocol (VoIP) technology, which allows them to easily create disposable, virtual phone numbers using apps like Google Voice. This makes it incredibly easy for bad actors to mask their location, hide their identity and initiate phone-based scams.

One of the most common phone-based traps to watch out for is the voice verification scam:

• Fraudsters target individuals selling items on public online marketplaces. A scammer contacts you pretending to be an interested buyer, but claims they need to verify you are a "real person" before proceeding.
• They will send a Google Voice verification code to your mobile device and ask you to read it back to them. In reality, they are attempting to set up a fraudulent virtual phone account using your cell phone number.
• If you give them the code, they activate the virtual line. They can now use that virtual number to launch untraceable phishing or call scams against other people. If law enforcement investigates the fraudulent activity, the trail leads back to your pilfered number.

Treat text-message verification codes like password credentials. Legitimate organizations will never ask you to read a verification code back to them over the phone to prove your identity. If a caller demands a code, hang up.

Types of bank account fraud

Once a scammer captures your sensitive data, they may use it to target your finances in several ways:

• Account takeovers: A fraudster uses your stolen credentials to log into your existing bank account, change your password and lock you out while draining your funds.
• New account fraud: A scammer uses your stolen identity to open brand-new credit cards, lines of credit or bank accounts in your name, leaving you with the resulting damage to your credit score.
• Peer-to-peer (P2P) payment fraud: Scammers trick you into sending money directly to them through digital apps like Zelle or Venmo for fake purchases or services. Alternatively, they may use your stolen credentials to link a new P2P account directly to your financial information.
• Debit and credit card fraud: Criminals obtain your physical card or card number to make unauthorized purchases. Fortunately, reporting the fraud immediately protects you from being held liable for these charges.

How to stay ahead of fraud and respond in the moment

Fraud prevention begins with staying one step ahead of scammers. You can quickly fraud-proof your phone, wallet and accounts by using these proactive security habits:

• Turn on real-time alerts: Set up push notifications in your mobile banking app to immediately flag any purchase or login attempt.
• Use biometric login: Enable facial recognition or fingerprint scanning on your devices and banking apps to prevent scammers from using stolen passwords.
• Switch to a digital wallet: Use secure platforms like Apple Pay or Google Pay. They hide your actual card numbers from skimmers during checkout.
• Keep an eye on your accounts: Check your credit report, bank account details and credit card accounts regularly, looking out for unusual activity or accounts you didn't open.
• Know how your bank contacts you: Be familiar with how and when your bank may contact you, and learn the common short codes used so you can easily recognize a message that is secure.
• Limit what you share: Never share sensitive information with a stranger over the phone or online. Go one step further and limit what you reveal on social media or other public forums.
• Pause before responding: If you receive a message you're not sure about, pause before you react. If it's an urgent request to take action or provide personal information, it's probably a scam.
• Verify the sender: If you're still not sure, contact the person or organization through a separate, known channel like a phone number you already have saved or an official website.
• Act quickly if compromised: If you accidentally share data or spot a scam, don't wait. Immediately change your passwords, use your banking app to "freeze" your cards and call your bank's fraud department to report it.

Protect yourself: Stay cyber alert

Citizens is committed to providing the tools and resources you need to bank safely. Our dedicated team is always here to help you achieve your financial goals securely. For more tips on keeping your digital identity secure, visit our Fraud and Security Center.

Frequently asked questions

What should I do if I already clicked a link in a scam text or email?

Don't enter any personal information on the page that opens. Close the browser, clear your cache and cookies, run a virus scan on your device and change your online banking password immediately.

How does Citizens Bank actually contact customers?

Citizens may contact you by phone or email to share system updates, verify recent account activity or inform you about new products. Legitimate text messages from Citizens come from short codes (five- or six-digit numbers). Citizens will never call, text or email you to ask for your password, account number or one-time passcode.

How do I report a scam text or email pretending to be from Citizens?

Do not reply to the message or click any links. Call the phone number on the back of your credit card, debit card or monthly statement. You can also report the scam to the Federal Trade Commission.