THE SERVICE IS REALUpdated October 16, 2026

A real EnFact text wants one word back. A text with a link is not one.

A text arrives about a suspicious charge on your debit card, from a company called EnFact that you have never heard of and that is not the name on your card. You search the name, and the results are a scatter of individual bank pages that each describe their own version. Nobody answers the actual question.

The answer is unusually clean, because a genuine EnFact text is allowed to do very few things.

The short answer

EnFact is real. It is a debit-card fraud-detection service from Fiserv, used by many US banks and credit unions. The banks that publish their rules describe a narrow signature for a genuine EnFact text: it comes from a five-digit short code, it never contains a link, it names the suspect transaction, and it asks you to reply with a single short word such as yes, no, help or stop. It never asks for your PIN, your full card number, your password, or a one-time passcode. A text that breaks those rules is not a real EnFact text, whatever it says at the top. Genuine follow-ups do exist, such as a call from your bank’s fraud centre, so verify anything beyond the text through the number on your card.

A fraud-alert name can be copied. Illustrative message: EnFact: unusual activity detected on your card. To cancel this payment, reply with the six-digit sign-in code we just sent you. — **A fraud-alert name can be copied.** Illustrative malicious message using a fraud-monitoring name. It is not a genuine EnFact alert or a universal template for bank messages. View the source. Open full-size image.Illustration added 6 October 2026.

What EnFact actually is

EnFact is a card-risk product from Fiserv, one of the large payment processors that runs card infrastructure behind the scenes for smaller banks and credit unions. Fiserv's own Card Risk Mitigation brochure describes EnFact as a sophisticated, real-time, neural network solution that assesses fraud risk for card transactions without delaying or inconveniencing cardholders. In plain terms, it watches your card and flags the transactions that do not fit your pattern. The same document notes that its supported notification channels include text, email and letters, which is why an alert can reach you more than one way.

That is the whole reason the name is unfamiliar. You never signed up for EnFact and it is not printed on your card, because your relationship is with your bank and your bank's relationship is with Fiserv. Pinnacle Bank, one of the institutions that publishes how it uses the service, describes the sequence: an email first, then a text message, and a phone call if there is no response within fifteen minutes. So an unexpected contact from a name you do not recognise is genuinely how the real system behaves, which is exactly why an imitation of it works so well.

Side-by-side comparison of a genuine EnFact debit card fraud alert text and a fake one. The real message comes from a five-digit short code, names the merchant and amount, and asks the cardholder to reply YES or NO. The fake comes from a ten-digit number and contains a link to click. — Recreated examples, not screenshots of real messages. The link in the fake is deliberately inert.

The signature of a genuine EnFact text

These are the properties banks that use the service publish about its texts. Each one is something you can check on the message in your hand, without calling anyone. They describe the institutions that publish them, so check your own bank’s page as well.

—It comes from a five-digit short code. SCU Credit Union states that a text alert from EnFact will always be from a 5-digit number and not a 10-digit number resembling a phone number. Winston-Salem Federal Credit Union and Hancock Whitney both name 37268 for their debit-card alerts. Codes differ between institutions, so check your own bank's published number rather than memorising one.

—It never contains a link. This is the strongest rule available and SCU states it without qualification: a text alert from EnFact warning you of suspicious activity will never include a link to be clicked, and cardholders should never click a link in a text supposedly from EnFact. A genuine text does not need you to tap something.

—It tells you about the transaction. A real alert carries the detail that lets you judge it. Winston-Salem FCU describes the message as offering basic information about the suspected transaction, including the amount and the merchant where available. Vagueness is not a feature of the genuine article.

—It asks you to reply with one word. Yes, no, help or stop. Winston-Salem FCU puts it as replying YES to mark a transaction legitimate, and STOP to the same short code to opt out. That is everything the text itself asks of you. If the bank needs more, it follows up separately: SCU says a Fraud Detection Center agent may call when it cannot reach you by text, and Winston-Salem FCU describes a further message with a number to call after a NO reply.

—It never asks for secrets. Pinnacle Bank states it directly: we will never ask you to verify your PIN or password via text or email. Not your PIN, not your full card number, not your online-banking password, and not a one-time passcode.

The one-word test. Put the five rules together and a single question does most of the work: what is this text asking me to do? A genuine EnFact text asks you to type one short word into a reply. It has no link and no form. Most fake versions need something bigger from you, because a reply of "no" earns a criminal nothing. If the text needs you to tap a link, log in, read out a code, or move money, it has already failed the test. A real follow-up, like a call from the fraud centre after a NO, can pass every check you run on it, so do not judge the call: hang up and ring the number on the back of your card. A genuine alert will still be there when you get through.

These checks describe EnFact texts; other banks use different services and sender details. For a message naming a different bank, consult our US bank fraud-alert sender register and follow the verification route on your bank’s own website. A matching sender is a clue, not proof that a message is genuine.

Where the fake version goes

A counterfeit fraud alert is rarely the scam by itself. It is the opening, and the FTC has documented where it leads. Its warning on text scams describes exactly this shape: some text scams start as fake fraud alerts, a message claiming to be from the fraud department at your bank, offering help with a suspicious charge. That is the hook to get you to reply or call a number, after which come the elaborate lies that drain the account.

Two demands mark the end of that road, and the FTC is unambiguous about both. One is the verification code: no caller, especially someone claiming to be from your bank's fraud department, will ever ask for it, because sharing the code is how a stranger proves to your bank that they are you. The other is the instruction to move money somewhere safe. In the FTC's words, your money is fine where it is, no matter how urgently someone says otherwise, and anyone telling you to move money to protect it is a scammer. We take that particular move apart in our breakdown of manufactured urgency.

From the field. I have spent my working life on the other end of persuasion, and the thing that makes a fake fraud alert so effective is not the wording. It is the role reversal. Every other scam has to talk you into trusting a stranger; this one arrives already on your side, warning you about someone else. Your guard goes up at the imaginary thief and stays down for the person in the message. That is why the tells here are deliberately mechanical rather than instinctive: a link, a ten-digit number, a request for a code. You are not going to feel your way out of a message engineered to feel like rescue. You check it against the specification instead, and when the specification is not enough, you call the bank yourself.

The safest move never depends on judging the message at all. Do not reply, do not tap, and do not ring any number the message gives you. Call your bank on the number printed on the back of your card, or open your banking app and look for the alert there. A real suspicious-transaction hold will be visible to the person who answers. A fake one will not exist.

What to do with the message in front of you

—Check the sender against the specification. Five-digit short code or a full phone number? Any link at all? Does it name the merchant and amount, or stay vague? One of those usually settles it.

—Reply only if it is a genuine short-code alert, and only with the one word. Confirming or denying a transaction by replying is the intended use. The text never needs more than that word. If a call or message follows, verify it through the number on your card before you answer anything.

—Verify independently the moment anything feels off. The number on the back of your card is the one contact route a scammer cannot control. Use it in preference to everything else, including a number found by searching.

—Never read out a passcode, and never move money to protect it. These are the two instructions that convert a scare into a loss. Neither has a legitimate version.

—Check the email sender carefully, but do not lean on it. Hancock Whitney publishes noreply@enfactnotifications.com as the genuine debit-card sender. A From line can be forged, so a matching address is reassurance, never proof.

If you already interacted with the message

—Describe the exact action. A reply, a link click, entering a bank password, sharing a verification code and sending money are different events. Tell the bank which happened and when.

—Secure access through a trusted route. Follow the bank’s fraud-team instructions. If credentials were exposed, change them through the genuine app or website and review account access. If you installed remote-access software, use another trusted device to contact the bank.

—Preserve the record. Keep the message, sender details, time, payment reference and bank case number. Do not forward secrets to anyone or post unredacted screenshots publicly.

—Report the impersonation. After urgent bank contact, report the attempt to the FTC at ReportFraud.ftc.gov. Keep evidence of anyone who follows up with a paid recovery promise.

The reason this scam works is that the real thing is genuinely strange: an unfamiliar company, an unexpected message, an urgent-sounding charge. You cannot make that feel normal, and you do not need to. The genuine text is narrow enough to describe in five rules, and a counterfeit usually has to break one of them to get what it wants.

Common questions

Is EnFact a scam?

No. EnFact is a real debit-card fraud-detection service from Fiserv, used by a large number of US banks and credit unions to spot suspicious card transactions and check them with you. If your bank uses it, a genuine EnFact alert really can arrive without warning. The problem is that criminals send fake fraud alerts too, because a message about a suspicious charge is the single most reliable way to make someone react before they think. So the question worth asking is not whether EnFact is real, but whether the specific message in front of you matches what a genuine EnFact alert looks like, and whether your bank confirms it when you contact it yourself.

Does a real EnFact text ever contain a link?

Not according to the institutions that publish their rules. SCU Credit Union, which uses the service, states it plainly: a text alert from EnFact warning you of suspicious activity on your card will never include a link to be clicked, and cardholders should never click a link in a text that is supposedly from EnFact. A genuine text describes the suspect transaction and asks you to reply with a short word. If there is a link in the message, treat it as a reason to stop and contact your bank through a route you already trust, no matter how convincing the rest of it reads. Check your own bank’s published rules too, because each institution describes its own alerts.

What number does a real EnFact text come from?

A short code, not a normal-looking phone number. SCU Credit Union states that a text alert from EnFact will always come from a 5-digit number and not a 10-digit number resembling a phone number. Winston-Salem Federal Credit Union and Hancock Whitney both name the same short code for their debit-card alerts: 37268. Short codes vary by institution and you should check your own bank’s published number. A fraud alert arriving from a full 10-digit mobile number is a warning sign, and a matching short code is a clue, not proof.

What email address do genuine EnFact notifications come from?

Hancock Whitney publishes it directly in its help centre: for debit cards, email notifications are sent from noreply@enfactnotifications.com, with text alerts from 37268. That domain looking unfamiliar is exactly why people search for it: it is the vendor’s domain rather than the bank’s, so it does not match the name on your card. Be careful with this in both directions. The address being correct does not make an email genuine, because a From line can be forged. Treat it as one signal among several, never as proof.

Should I reply YES or NO?

Replying to a genuine short-code alert is how the service is meant to work: Winston-Salem Federal Credit Union describes replying YES to confirm a transaction. A NO reply can lead to a further message with a number to call, so a follow-up after NO is not by itself a sign of fraud. If you are not sure the alert is genuine, skip the reply and contact your bank through its app or the number on your card first.

Will EnFact or my bank ever ask for my PIN, card number, or a one-time passcode?

Not by text or email. Pinnacle Bank states it flatly: we will never ask you to verify your PIN or password via text or email. The FTC goes further on verification codes, warning that no caller, especially someone claiming to be from your bank’s fraud department, will ever ask for the code, because sharing it lets the scammer prove they are you. A genuine EnFact text needs one thing from you: confirmation that a transaction was or was not yours. It never needs your full card number, your PIN, your online-banking password, or a passcode that was just texted to you.

I already replied, clicked or shared something. What should I do now?

Stop interacting with the sender and call your bank on the number printed on the back of your card, not any number from the message. Tell them exactly what happened, because a reply, a click without entering anything, a password typed into a page, a shared passcode and money sent are different events. If you gave a one-time passcode, installed remote-access software or moved money, say so immediately, because speed matters most in the first hours. Ask them to lock the card and check for new payees or changed contact details, and change your online-banking password from a device you trust. Then report it to the FTC at ReportFraud.ftc.gov. If anyone later contacts you offering to recover the money for a fee, that is a second scam aimed at the same victim. Do not wait for a Tutela case review before calling your bank.

Sources

Bank pages rechecked October 16, 2026, except Winston-Salem FCU, which blocks automated reading; its details were last read September 29, 2026. Bank procedures change, so use your own provider’s current instructions.