In short
Most common fake: Fake fraud alert asking you to reply or tap a link about a charge.
Safest check: Do not use any link or number from the message.
Where to report it: Forward suspicious emails that use Bank of America's name to abuse@bofa.com.
What Bank of America says
Bank of America says it may ask you to confirm account activity, but it will never ask for your password or verification code, or ask you to send money to it or anyone else as part of that check. It also says it will never text you asking for account details. Source: Bank of America
Common fake Bank of America messages
These are the 5 shapes a fake Bank of America message usually takes. They are listed in the order we see them most often, and none of them is something Bank of America itself does.
- Fake fraud alert asking you to reply or tap a link about a charge
- Text saying your online banking has been suspended
- Caller who says a bank employee is under investigation and your money must be moved
- Request for your one-time verification code
- Instructions to buy gift cards or crypto to protect your funds
Bank of America's real web addresses
Genuine Bank of America links and emails use these domains. Look at the part just before the first single slash: bankofamerica.com is real, but bankofamerica-support-center.com or bankofamerica.com.account-check.top are not.
- bankofamerica.com
- bofa.com
Scammers can also hide a fake link behind real-looking text. Learn how to read a web address.
How to check a Bank of America message safely
- Do not use any link or number from the message
- Open the Bank of America app or type bankofamerica.com yourself to check alerts
- Call the number on the back of your card or on your statement
- Never share a password or verification code, even with someone who says they are from the bank
How to report a fake Bank of America message
- Forward suspicious emails that use Bank of America's name to abuse@bofa.com. Official details on web.bankofamerica.com
- Forward suspicious texts to 7726 (SPAM) to alert your mobile carrier. Official details on web.bankofamerica.com
- Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov. Official details on reportfraud.ftc.gov
Also report it to the official fraud service in your country. See the worldwide list.
If you clicked, paid or shared details
Act quickly. It makes a difference.
- If you entered card or bank details, call your bank now using the number on your card, and ask them to block the card.
- If you entered a password, change it at bankofamerica.com, typed into your browser yourself, and turn on two-step verification. Do not use any link from the message.
- Expect follow-up calls or messages pretending to help, sometimes claiming to be from Bank of America security. Never share one-time codes and never move money to a "safe account".
- Forward suspicious emails that use Bank of America's name to abuse@bofa.com, then delete the message.
More help: Phishing links and fake login pages and what to do after a scam.
How to protect yourself next time
Use a password manager
It only fills in your password on the real website, so a look-alike login page gets nothing. It also makes a different password for every account, so one leak doesn't open the rest.
Free: Bitwarden has a free plan, and even the password manager built into your phone or browser beats reusing one password everywhere.
- NordPass Partner link Password manager with a free plan and a family plan for up to six people.
Turn on two-step verification, ideally with a security key
With two-step verification, a stolen password isn't enough on its own. A hardware security key goes further: it simply doesn't work on a fake site, so it can't be phished.
Free: Two-step verification is free. Switch it on in the security settings of your email, bank, WhatsApp and social media accounts today.
- YubiKey (Yubico) Partner link A small USB or NFC key you tap when you log in. It will not work on a fake site.
Compare the tools that help, and what each costs
Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.
Questions people ask
Does Bank of America send messages asking for payment or personal details?
Bank of America says it may ask you to confirm account activity, but it will never ask for your password or verification code, or ask you to send money to it or anyone else as part of that check. It also says it will never text you asking for account details.
How can I check if a Bank of America message is real?
Do not use any link or number from the message. Open the Bank of America app or type bankofamerica.com yourself to check alerts. Call the number on the back of your card or on your statement. Never share a password or verification code, even with someone who says they are from the bank.
How do I report a fake Bank of America message?
Forward suspicious emails that use Bank of America's name to abuse@bofa.com. Forward suspicious texts to 7726 (SPAM) to alert your mobile carrier. Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov.
I clicked a link in a fake Bank of America message but did not enter anything. Am I at risk?
Opening a link is far less serious than filling one in. Close it, and if you need your account, reach it by typing bankofamerica.com yourself. Clicking does tell the sender your number is live, so expect more messages for a while: forward suspicious emails that use bank of america's name to abuse@bofa.com.
Have you had this one?
Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.
No stories yet. Yours could be the one that warns someone.
Official sources and further reading
We check our pages against official advice from the organisations themselves and from government agencies.
- Report Suspicious Activity (Bank of America)
- Learn About the Latest Scams (Bank of America)
- What is smishing and how to prevent it (Bank of America)