Fake CommBank and NAB Account Alert SMS — How to Spot It Instantly (2026)

Bank impersonation scams in Australia have become more precise, more localised, and far more convincing in 2026. Messages claiming to be from Commonwealth Bank of Australia (CommBank), National Australia Bank (NAB), Westpac, or ANZ are now designed to blend seamlessly into real message threads — making them harder to detect at a glance.

This guide breaks down exactly how these scams work, what to look for, and how to verify them in seconds.

Why Bank Impersonation Scams Work

These scams succeed because they exploit trust and urgency simultaneously.

• Trust layer: Australians are familiar with their bank’s SMS style — short alerts, transactional language, and branded sender IDs like “CommBank” or “NAB.”
• Urgency trigger: Messages use phrases like “account suspended”, “unauthorised transaction detected”, or “verify immediately” to force quick action.

Modern attackers also use SMS spoofing, meaning the message can appear in the same thread as legitimate bank alerts. This removes the usual suspicion people might have when receiving a message from an unknown number.

3 Most Common Fake Bank SMS/Email Types (2026)

1. “Account Suspended / Locked” Alert

Example pattern:

“CommBank: Your account has been suspended. Verify now to restore access.”

Red flags:

• Sender ID spoofing: Appears as “CommBank” or “NAB” but may not behave like past messages (different tone or formatting).
• URL structure:
  • Fake: https://cba-secure-login.verify-update.com
  • Real banks do not use multi-hyphen, multi-word domains like this.
• Language pattern: Slightly aggressive or threatening tone (“failure to act will result in closure”).

2. “Unauthorised Transaction” Panic Message

Example pattern:

“NAB Alert: $1,250 transfer flagged. If this wasn’t you, secure your account here: [link]”

Red flags:

• Time pressure: Encourages immediate action without allowing verification.
• Link mismatch: Domain may include banking keywords but isn’t the official domain (nab.com.au).
• Generic phrasing: No partial account details or personalisation.

3. “Secure Message / Update Details” Email or SMS

Example pattern:

“Westpac: You have a secure message waiting. View it here.”

Red flags:

• Ambiguity: Doesn’t specify what the message is about.
• Hidden redirects: Link may pass through multiple domains before landing on a fake login page.
• Brand inconsistency: Fonts, spacing, or tone differ slightly from official communications.

Exact Red Flags to Check Instantly

Across all scam types, three technical indicators stand out:

1. Sender ID Behaviour

• Real banks use consistent sender IDs.
• If a message suddenly introduces urgency or a link where previous messages didn’t — treat it as suspicious.

2. URL Structure

• Official domains:
  • CommBank → commbank.com.au
  • NAB → nab.com.au
  • Westpac → westpac.com.au
  • ANZ → anz.com.au
• Scam domains often:
  • Add extra words (secure, verify, update)
  • Use hyphens or unusual subdomains
  • End in non-standard extensions

3. Language Patterns

• Real banks: neutral, structured, no panic
• Scam messages: urgency + consequence (“act now”, “immediate action required”)

The 3-Step Verification Protocol

Before clicking anything, follow this:

Step 1 — Don’t Trust the Message Thread
Even if it appears in a legitimate SMS conversation, assume it can be spoofed.

Step 2 — Check the Link Structure
Long-press (don’t tap) the link and inspect the domain carefully.

Step 3 — Verify via Official Channel
Open your bank’s official app or type the website manually in your browser — never use the link provided.

What To Do If You Already Clicked

If you’ve interacted with a suspicious link:

1. Do not enter any credentials if the page looks even slightly unusual.
2. Immediately contact your bank using the number on their official website or app.
3. Change your passwords for banking and email accounts.
4. Monitor transactions closely over the next few days.
5. Report the incident to Scamwatch to help prevent others from being targeted.

Final Thought

Bank impersonation scams are no longer obvious. They are engineered to look familiar, feel urgent, and bypass your usual caution.

The safest approach is simple: never trust the message — always verify the source.

Check It Before You Click

If you receive a suspicious bank SMS or email, don’t guess.

Paste the link into OziShield — free, no login, 10 seconds.