Is this bank text real? Check published US bank short codes.
A text says there is a suspicious charge on your card. It wants a YES or a NO, or a tap, or a call. The sender number is one clue, and banks publish their numbers on different pages. It cannot settle the question on its own. So we read those pages, on one day, and put the numbers in one place.
Real bank fraud alerts come from short codes, the five- or six-digit numbers each bank publishes. Chase uses 28107, 36640 and 72166. Capital One uses 227898, 227767 and 227373. Navy Federal uses 20270 and 33748. Truist uses 878228, PNC 94387 and 76205, KeyBank 65076 and 72678, USAA 698722 and 868722. Many fraud alerts name a transaction and ask for a YES or NO reply, but formats differ. Some legitimate bank messages contain links, including Chase’s requested self-service messages. Never share a passcode or move money in response to an unexpected alert. An unfamiliar sender or unexpected request is a reason to verify independently, not a conclusive verdict.
Find your bank in the short-code directory ↓
Is a text from 227767 really Capital One?
227767 is one of Capital One’s published short codes. Capital One lists it alongside 227898 and 227373 for account-servicing messages such as fraud alerts. We rechecked its official SMS terms on 5 October 2026. A listed number is one clue; verify an unexpected request through the app or the number on your card before acting.
"Some of the costliest impersonation scams start with a fake security alert, often from a bank. People are convinced to move money to 'protect' it, with their losses often limited only by their available funds."
The fake fraud alert is not a new trick and it is not a subtle one. The FTC's own text-scam spotlight put copycat bank fraud prevention alerts at number one for 2022, with a median loss of $3,000 and reports up nearly twentyfold since 2019. By 2024 people were reporting $470 million lost to scams that started with a text, and the fake bank alert was still on the FTC's list of the most reported kinds. What has changed is only the polish.
Sender numbers can help you check a message, but they do not authenticate it. The register below records published short codes, not every channel a bank might use. Chase explicitly says its list is not exhaustive and documents requested self-service texts containing links. If a message is unexpected, verify through the official app or the number on your card rather than replying or tapping.
The register: every code, read on the bank's own page
Each row below was read on the institution's published page on 9 September 2026. The fraud or security codes are set large; everything else the bank publishes sits beside them, because a one-time passcode arriving from a code listed for passcodes is also information. The source link on each row is the thing to trust when this table and the bank disagree.
Two rows deserve a word. Bank of America publishes short codes only for Zelle enrolment codes on the page we could reach; its fraud-alert number is not on any public page we found, and the numbers circulating for it on third-party sites are not something we will repeat as fact. Wells Fargo's FAQ names one code, 93557, which spells WELLS on a keypad, for enrolment, alerts and passcodes together. Neither is a criticism. It is the reason a list like this has to say where each number came from.
The codes people search for most, and who owns them
Google's own data on what people type is the reason this page exists. The searches are for a bare number followed by the words text message, and the four most searched are these. The AI side agrees: in our AI Scam Query Index, the plain question "check scam" is the second most grounded query Microsoft's assistant sends when it cites us.
Why a matching code is still not proof
Reading the eleven pages side by side turned up something no single bank's page will tell you. Two of the codes belong to two banks at once. PNC lists 32858 for one-time passcodes; so does KeyBank. PNC lists 668439 for identity verification; Navy Federal lists it for one-time passcodes. That is not a mistake on anyone's part. It means the code belongs to the vendor that runs the messaging platform, not to the bank whose name is in the text, and several institutions ride on the same vendor.
The consequence is simple. A short code proves that a registered business platform sent the message. It does not by itself prove which business, and it says nothing about what the message will ask you to do next. The FTC describes the live version: a text asks you to reply yes or no to a large transaction you did not make, and when you reply, the call comes from the fake fraud department. The number checked out well enough to get a reply. The reply is what they wanted.
What a real alert can ask, in the banks' own words
The banks agree with each other on this, which is unusual enough to be worth quoting directly.
Who is not on the register, and why that is not a verdict
Discover's SMS terms say it may text about fraud activity independent of your alert preferences, but they name no code. U.S. Bank's alert pages describe text, email and push alerts and name no code. Citi's card-benefits page and Cash App's scam page refused to load for us, and American Express's US pages we could read name none. That is four large institutions whose fraud alerts we cannot help you check by number today, and it is the honest limit of a register built from published pages.
So read the absence correctly. A bank missing from the list means we could not verify its code at source. It does not mean a text from that bank is fake, and it does not mean a text from a five-digit number is real. For those institutions the second and third tests carry the whole load: independent verification through the official app or the number on the back of the card. We will add rows as banks publish, and the date at the top of the table will move when we re-read it.
A message naming Link or Stripe may concern saved checkout details rather than a bank fraud alert. For that different message type, see what an unexpected Link or Stripe verification text means and how to check the account independently.
If you already replied, tapped, or read out a code
- 1.Call the bank on the number printed on the back of your card, not any number from the message or from a search result. Say exactly what you shared and, if you moved money or read out a passcode, say that first.
- 2.Ask for the card to be locked and for a check on new payees and changed contact details. A criminal who has your passcode often changes the phone number on file so the next alert goes to them.
- 3.Change your online banking password from a device you trust, and turn on any extra verification the bank offers.
- 4.If money moved, ask about the rail. An unauthorised card transaction and a transfer you were talked into are treated differently; whether banks refund scammed money depends on which one you have.
- 5.Report the text. Forward it to 7726, then report at ReportFraud.ftc.gov. Reporting does not get your money back, but it is what the FTC's numbers above are built from.
- 6.Expect the second call. Anyone who contacts you afterwards offering to recover the money for a fee is running the recovery scam, aimed at the same victim twice.
Every fake fraud alert is built on one bet: that you will answer the message before you check the sender. Read the sender as one clue. Verify unexpected requests independently, even when the number appears to match.