Numbers and messages
Is That Message Really From Your Bank—or Someone You Know?
Separate the claimed identity from the request, verify independently and act safely if you entered information or sent money.
Illustration — fictional scene, not a live result.
- Unexpected message
- Independent route
Never verify a suspicious message using only information inside the same message.
On this page · 4 min read
- Read the requested action before the signature
- Verify a bank notice through the bank
- Check a personal request outside its conversation
- Keep credentials and account changes under your control
- Use CyberShield as one source of context
- If you already acted, prioritise the exposure
- Warning signs
- What to do next
- Sources
Key takeaways
- Judge the request, not just the logo or writing style.
- Use a separate trusted channel to verify identity.
- Secure exposed credentials promptly.
Read the requested action before the signature
A message may use a bank's name, a friend's photograph or a familiar greeting while asking you to do something risky. Focus first on the action: follow a link, share a code, move money, install something or avoid discussing it with anyone. You do not need to reply to investigate every inconsistency. Pause and use a separate trusted route to check the situation. Language quality is not a reliable test; a well-written message may still be deceptive, and a genuine sender can make spelling mistakes. Urgency should not decide for you.
Verify a bank notice through the bank
Open the official app you already use or obtain the bank's contact details independently. Do not treat a number in the suspicious message as an independent verification channel. Explain the request without giving a password or one-time code to the original sender. NCB's security centre advises protecting login access codes and monitoring card activity; that is bank-specific guidance, not a universal description of every bank's procedures. If you are not an NCB customer, use your own institution's current official instructions. No article can validate a particular message merely because it carries a logo.
Verify outside the message
- Pause the conversation
- Do not use its link or number
- Find an independent official route
- Verify the request separately
Never verify a suspicious message using only information inside the same message.
Check a personal request outside its conversation
If a contact says they have changed numbers, lost access or need urgent financial help, use a route you previously trusted to verify the request. A reason for avoiding a call is not conclusive proof of fraud, but it does not replace verification. Ask a trusted mutual contact if appropriate without distributing the whole private conversation. Do not send a small payment as an identity test: it can still be lost and does not prove who controls the account. You can say that you will only act after independently confirming the details.
Keep credentials and account changes under your control
Do not share a login code to stop an alleged fraud or to help someone recover their account. If a message says an account will close, inspect it through the official service rather than its supplied link. JaCIRT's phishing guidance identifies unexpected personal-information requests and suspicious links as warning signs. Do not open a questionable link merely to decide whether it looks professional. If you are unsure what a code is for, read the original notification privately and use the provider's own help route. Never paste access tokens or reset links into a public post.
Use CyberShield as one source of context
Search a relevant number, account or domain without assuming that a match establishes the sender's identity. No match is not proof of safety. The message-checking flow uses local rules and moderated public-intelligence matching; it does not use external AI or URL reputation lookups. A separate link checker depends on an available provider and has its own limits. OCR and automated screenshot analysis are unavailable. A screenshot can still be submitted as private report evidence through the reporting flow; that is not automated certification of the message or a promise that it will be published.
If you already acted, prioritise the exposure
If credentials were entered, change the affected password through the official service, enable MFA where available and review active sessions. Change reused credentials on other affected accounts as well. If money moved, contact the financial institution or payment provider promptly and ask what options exist. Preserve the message and transaction details privately. You can report through the relevant service and consider appropriate official routes. A verified CyberShield account can submit a free community report for moderation, but it does not replace those actions. Nobody should promise recovery in exchange for another fee or a secret access code.
Warning signs
- A request to share a login or recovery code.
- A threat demanding immediate payment or secrecy.
- A message-supplied phone number offered as the only verification route.
What to do next
- Pause and use the official app or independently obtained contact route.
- Secure affected accounts if information was entered.
- Preserve the message and report through appropriate channels.
Education is not a finding about a person or business. Reports are allegations; no match does not mean safe. A CyberShield report does not replace an appropriate official report.
Sources
- NCB Privacy and Security Centre — accessed 2026-09-24
- JaCIRT: Phishing Scams, How to Recognize Them? — accessed 2026-09-24
- JCF: WhatsApp impersonation warning — accessed 2026-09-24
General safety guidance, not a finding about a person or business, legal advice or a promise of recovery. CyberShield does not replace your bank, police, regulator or consumer authority.
Share this with someone who is about to pay
