BANK ALERTS · UPDATED SEPTEMBER 29, 2026

Is that EnFact notification real? Verify it through your bank.

A real service can send an unfamiliar-looking alert. A scammer can copy that alert. The useful question is how to check this particular message without handing the sender control of your next step.

The short answer

EnFact is a real fraud-monitoring service, but its name does not authenticate a message. SCU Credit Union says its EnFact texts have no links; Winston-Salem Credit Union publishes 37268 and describes a follow-up call after a NO reply. Check your own bank’s rules. If unsure, open its app yourself or call the number on your card before responding.

A fraud-alert name can be copied. Illustrative message: EnFact: unusual activity detected on your card. To cancel this payment, reply with the six-digit sign-in code we just sent you. — **A fraud-alert name can be copied.** Illustrative malicious message using a fraud-monitoring name. It is not a genuine EnFact alert or a universal template for bank messages. View the source. Open full-size image.Illustration added 6 October 2026.

Have the message open? Do this first.

—Only received the alert? Leave its links and phone numbers alone. Open your usual banking app yourself, or call the number printed on your card. Ask whether the bank sent the alert and whether your card needs attention.

—Shared a code, password or money? Call the bank’s fraud team now. Tell them what you shared or paid, and ask them to secure the account and investigate. Do not wait for a reply from us.

—Already spoke to the bank? Keep its case reference and the message. If its explanation is unclear, the optional review below can help you organize questions for the bank.

Check your bank’s published alert details →

Why the unfamiliar name can be legitimate

EnFact is a Fiserv card-fraud monitoring product. Your relationship is with your bank; the alert can carry the name of the service behind it. An unfamiliar vendor name therefore does not settle whether an alert is genuine. Equally, recognizing that name does not make an unexpected request safe.

SCU Credit Union describes text alerts followed, when necessary, by a call from a fraud analyst. Different channels can be legitimate. The safeguard is an independent contact with your institution, rather than deciding from the message’s appearance alone.

What participating banks actually publish

SCU Credit Union: its EnFact fraud texts use a five-digit sender and do not include a link. Its instructions are specific to its cardholders. Read SCU’s alert rules.

Winston-Salem Credit Union: texts come from 37268. A YES reply confirms the transaction; a NO reply can produce another message with a number to call. If you are unsure, call through your card or app instead. Read WSCU’s process.

Hancock Whitney: its debit-card alert details include 37268 and noreply@enfactnotifications.com. This is a useful comparison, not proof of a message’s origin. Read Hancock Whitney’s sender details.

A text matching those details still needs to make sense for your bank and your card. For other services, our US bank fraud-alert sender register links to institutions’ own instructions. Do not use another bank’s sender code as a substitute for checking yours.

The request matters more than the costume

A fake fraud alert borrows the role of a protector. Once the sender sounds like the person preventing a theft, their next instruction can feel like a safety step. That is the point at which to leave the conversation and contact the bank yourself.

Do not share a sign-in code or move money to a “safe account.” The FTC warns that people posing as fraud staff use those requests to take control of accounts or payments. A caller’s knowledge of your name or a transaction does not replace independent verification.

The old shortcut “a genuine alert only ever wants one word” fails because legitimate follow-up procedures exist. The stronger rule works across message formats: the unexpected sender does not get to choose the channel through which you verify them.

If you already interacted with the message

—Describe the exact action. A reply, a link click, entering a bank password, sharing a verification code and sending money are different events. Tell the bank which happened and when.

—Secure access through a trusted route. Follow the bank’s fraud-team instructions. If credentials were exposed, change them through the genuine app or website and review account access. If you installed remote-access software, use another trusted device to contact the bank.

—Preserve the record. Keep the message, sender details, time, payment reference and bank case number. Do not forward secrets to us or post unredacted screenshots publicly.

—Report the impersonation. After urgent bank contact, report the attempt to the FTC. Keep evidence of anyone who follows up with a paid recovery promise.

Report the impersonation to the FTC →

Common questions

Is EnFact a scam?

EnFact is a legitimate fraud-monitoring service used by participating financial institutions. That does not prove a particular text, email or call is genuine. Verify an unexpected alert through your bank using a contact route you already trust.

Does a genuine EnFact text contain a link?

SCU Credit Union explicitly says its EnFact fraud texts never contain links. Treat a link as a reason to stop and verify through your bank, not as an invitation to log in. Do not assume one institution’s published message format describes every bank and every channel.

Is 37268 a genuine EnFact number?

Winston-Salem Credit Union and Hancock Whitney publish 37268 for their debit-card alerts. Check whether your own bank publishes the same code. A matching sender or familiar message thread is not enough to authenticate the particular request.

Is noreply@enfactnotifications.com legitimate?

Hancock Whitney lists noreply@enfactnotifications.com as its debit-card alert email sender. A displayed From address can be forged. Check your bank’s published guidance and verify the alert independently; do not send passwords, PINs or sign-in codes in reply.

Should I reply YES or NO?

Some banks use YES and NO replies to verify transactions. If you are uncertain whether an alert is genuine, contact your bank independently first. Winston-Salem Credit Union says replying NO can lead to a further message with a number to call, so “anything beyond one word is fake” is not a reliable test.

What if I already clicked or shared a code?

Stop interacting with the sender. If you entered a password, disclosed a code, installed remote-access software or sent money, contact your bank’s fraud team immediately using the number on your card. Explain exactly what happened. A click without entering information is different from disclosing credentials; tell the bank which occurred. Do not wait for a Tutela case review.

Sources

Official guidance checked September 29, 2026. Bank procedures and app menus can change; use the current instructions from your own provider.