Unexpected Text Messages

If you own a cell phone, it’s likely that you’ve received a suspicious text message in the last year claiming you owe toll fees, that there’s a package waiting for you at the United States Postal Service or that a UPS delivery could not be completed. These messages typically contain a link to a website that’s designed to look like an official, but clicking on the link can put your personal and financial information at serious risk.

Those who click the link in these messages are brought to a fraudulent website that asks for credit or debit card information before proceeding. Alarmingly, some of these fake websites collect your card details, even if you type them in without hitting “submit”.

Once card information is entered and the user proceeds to the next step, the site will typically instruct the user to wait for a one-time passcode from their bank to “verify” the transaction. In reality, scammers are attempting to enroll the debit or credit card into a Mobile Wallet, such as Apple Pay or Google Pay, allowing their debit or credit card to be accessible from a mobile device.

When the bank sends the verification code, the fraudster tricks the victim into entering it into the fake website. This gives the scammer the code they need to finalize the card’s enrollment on a phone that’s controlled by them. These cards are then used for online or tap-to-pay purchases, leaving victims with fraudulent charges. This organized scam allows fraudsters to load multiple cards onto a single device, typically an Apple or Android phone, which are then sold for others to use.

Fortunately, there are several simple steps you can take to protect yourself from this kind of fraud.

Don’t click suspicious links. If you receive a message from an unknown number claiming to be from a toll service, USPS, UPS or any other organization, do not click any links. Instead, navigate to the official website or call the organization directly using contact information you know is legitimate.
Verify the source. Look for warning signs such as poor grammar, strange web addresses or a sense of urgency in the message. Legitimate companies rarely ask for sensitive information through text messages.
Never enter sensitive information into unknown sites. Never type your credit or debit card information into a website unless you’re sure it’s official. Even if you don’t click “submit”, your information could still be used.
Never share one-time codes. Your bank will never ask you to send a verification code to a third-party website or person. If a site or caller asks for a code sent to your phone, it’s almost certainly a scam.
Monitor your accounts regularly. If you aren’t already enrolled, sign up for Online and Mobile Banking to be able to see your accounts in real-time and set alerts for account activity. Additionally, Visa Purchase Alerts sends a notification via email or text message when purchases are made on your Royal Bank Visa Debit Card so you can act immediately if unauthorized transactions are being made on your card.

Scammers are becoming more sophisticated, and awareness is your best defense. By staying informed and cautious, you can protect your personal and financial information from being misused by fraudsters.