A text appearing in the same conversation as genuine AIB messages can still be fraudulent. Do not use its position in the thread as permission to follow a link, call a supplied number or disclose a code. Leave the message and contact the bank through your existing app, the number on your card or its independently reached official website.
The difficult part is often the follow-up call. Someone who says they are stopping the fraud may be continuing the same scam, using information you just entered to sound convincing. This guide explains that sequence for AIB customers, with Republic of Ireland personal banking as the main context. Customers of other AIB entities should use the contact route and account instructions for their own region and product.
Break the text-to-action chain first
An alert may say that a payment is waiting, a device has been added or access has been blocked. Before deciding whether any of that is true, stop the requested action. You can investigate an account problem without using the link or telephone number chosen by the person who sent the alert.
Open the banking app you normally use rather than installing one offered in the message. If you cannot access the app or are unsure what an alert means, use a trusted bank contact. Do not continue entering information on a page because it promises that one final code will let you cancel everything that happened before it.
A familiar sender thread is not independent proof
AIB’s smishing guidance says fraudulent messages can appear in a thread containing legitimate messages. The conversation’s history therefore does not authenticate each new item. It is possible to recognize yesterday’s genuine notification and still receive a different sender’s deceptive request in what looks like the same familiar place.
That does not mean you need to diagnose the telephone network or inspect technical message headers before responding safely. The practical check is simpler: move to a route you established independently. If the text is about an actual banking event, the bank can investigate it without needing you to trust the thread’s appearance.
Examine the requested action, not only the wording
A fictional text might say “New phone detected. Review now” and link to a page asking for registration details. The threat of a new device makes the request feel protective, but entering information into an unverified form can create the access you fear. The word “review” does not limit what the form can do with your information.
Ask whether you started the process and whether the real app confirms the same action. A polished page, accurate spelling and a padlock do not answer those questions. An address containing a bank’s name can still belong to somebody else. Avoid trying to establish a page’s honesty by supplying a small amount of real banking information.
AIB can send genuine alerts, so avoid blanket rules
AIB documents genuine fraud text alerts for card transactions. It also warns against texts that lead you to disclose registration details, a Personal Access Code, card information or security codes. These facts matter together. Saying “AIB never sends texts” would make the advice simpler but inaccurate.
If you are uncertain about an alert, verify through the bank’s established contact route rather than replying experimentally or relying on a number copied from an old post. Use the current official instructions for your product. Genuine notification services do not turn every incoming instruction bearing the same name into a trustworthy request.
Treat a follow-up fraud-desk call as unverified
A caller may know your name, the last details you typed or the reason you were worried. That information can come from the form you just used. The caller may also describe a transaction you do not recognize and ask you to help cancel it. Accurate context is not the same thing as independently verified identity.
End the conversation and contact the bank through a trusted route. Do not ask the caller for a number and treat that answer as the verification step. If the caller pressures you to remain connected or says that hanging up will trigger a loss, that pressure is another reason to step outside the conversation and establish who you are actually dealing with.
Read the real purpose of a code or approval
A one-time code can be part of signing in, enrolling a device or authorizing a transaction. The caller’s description does not change the action the genuine system is requesting. Read the message or prompt itself, including any amount, payee or device information it displays, and stop if it concerns something you did not initiate.
AIB’s published fraud warnings describe codes being requested under the pretext of cancelling transactions. Do not disclose codes from a text or card reader to an unsolicited caller. If you already supplied one, tell the bank that specifically. Reporting “I gave my details” may leave out the approval that is most important to investigating the sequence.
Do not move money to a supposedly safe account
One version of the follow-up story says that the bank account is compromised and the balance must be moved elsewhere. The caller supplies the destination and presents the transfer as protection. AIB explicitly warns that it will not ask customers to move funds to a so-called safe account.
Do not make a small transfer to test the arrangement or move funds while waiting for a promised confirmation. The request itself is the point at which to stop and contact the bank independently. A familiar caller name, a plausible case number or knowledge of your recent activity does not make a destination supplied by that caller yours.
If you clicked but disclosed nothing
Close the page and record whether a download, permission request or other action followed. Opening a link does not by itself prove that money moved or a banking login succeeded. Check the account through your own route and consult the bank if anything is unfamiliar or you are unsure what the page did.
Avoid accepting a page’s claim that a device is infected, a payment is pending or a security scan is required. Do not install the repair utility it offers. If you are uncertain whether the form sent information before the final button, tell the bank what you typed and which steps you reached rather than assuming an unfinished form transmitted nothing.
If registration details, an access code or card data were exposed
Contact AIB promptly through its verified fraud-support route. Explain which details were entered and whether you also disclosed a code, approved a prompt or received a follow-up call. Let the bank guide the appropriate access and card-protection steps. Do not keep returning to the suspicious site to see whether the information still works there.
If a password used elsewhere was also involved, secure those other services independently. Keep banking credentials and live codes out of email reports or notes shared with a helper. A clear report can identify the kind of information disclosed without distributing the secret again. Use the bank’s secure process when it requests evidence or account identification.
If you approved something or transferred money
Report the event immediately using a trusted bank contact. State whether you initiated a transfer because of the caller’s instructions, entered a code or approved a genuine app prompt. Include the time, amount, destination details and reference you can see. Do not wait for the suspicious caller to explain why the balance has changed.
Preserve confirmation screens privately and tell the bank if another approval may still be pending. The available response depends on what happened, so no guide can promise reimbursement or a successful reversal. Accurate timing and the actual action taken are more useful than trying to describe the incident in language that sounds more favorable.
If remote access or another app was involved
Tell the bank if the caller persuaded you to install software, share a screen or allow control of the device. That is a different exposure from reading a text. Do not assume that closing the call removes the app or ends every permission it received. Stop using the suspect assistance and obtain appropriate technical guidance for the device.
Use another trusted device or contact route if you are unsure whether the original one remains under someone else’s control. For a work device, involve the responsible IT team. Do not follow new “cleanup” steps from the same caller or erase records impulsively before asking the bank and relevant technical support what evidence they need.
Find the right fraud contact for your account
The AIB Security Centre publishes different contact information for regions and for personal and business banking. Start with the bank’s official site or the contact details already associated with your account. This avoids the risk of reaching an unrelated product line or calling a fraudulent number included in the original text.
When money may already be moving, use the relevant urgent fraud-reporting route rather than sending an ordinary email and waiting. Check the current official page for availability and the correct number. A screenshot of an old contact list should not override current information reached independently from the bank itself.
Keep a timeline that distinguishes claims from events
Write down when the text arrived, which page you opened, what you typed and when the call began. Separate the caller’s claims from observations in the real banking app. “They said a payment was cancelled” is different from a cancellation you can verify in the account. Record any genuine notifications that appeared during the exchange.
Add the bank’s case reference and the protective steps it asked you to take. Keep full account numbers and transaction evidence private. This record can help avoid repeating the same account story to several teams and makes later calls easier to verify. It should not become a public document containing everything another impersonator would need.
Expect another approach after the first attempt
An impersonator may call again as an investigator, a compensation service or someone recovering lost funds. Knowledge of the incident can make this second approach persuasive. Use the case reference through the real bank’s established route rather than accepting the new contact as proof that an investigation has started.
Do not pay a recovery fee, disclose another code or transfer money to release compensation at an unsolicited person’s request. Verify any claimed next step independently. If you receive a message about the genuine case but are unsure of it, contact the organization through the route you already established and ask whether that communication is part of its process.
Help someone else without collecting their banking secrets
Ask the person what happened in order and let them contact the bank through their own account or telephone. Avoid criticism that could make them hide a code or payment they approved. You can help write a timeline and locate the official contact page without asking them to send you screenshots of live credentials.
For the future, agree on one pause point: an unexpected text or call must not become an immediate disclosure, approval or transfer. Leave the conversation and use the known bank route. That habit still works when the message looks professional, sits in a genuine thread and is followed by a caller who seems to know exactly what happened.
Questions about AIB phishing texts
Is a text genuine if it appears beside earlier AIB messages?
No. AIB warns that fraudulent texts can appear in legitimate message threads. Use the thread as a record of messages, not as proof of the sender of each one. Verify an unexpected instruction through your banking app or an independently established bank contact before supplying information or approving anything.
Does AIB ever send real fraud text alerts?
Yes. AIB documents a genuine card-alert service, so a blanket rule that every text is fake is inaccurate. When uncertain, consult the current official guidance or contact the bank through a trusted route. The existence of genuine alerts does not authenticate a text asking for secrets through a link.
Can I share a code to cancel a payment?
Do not give a live code to an unsolicited caller. A code can authorize an action even when the caller claims it is cancelling one. Read the genuine prompt and contact the bank independently if you did not initiate it. Tell the bank explicitly if you already shared a code or approved a request.
Should I move my balance if the caller knows my account details?
Do not transfer funds to a “safe account” supplied by the caller. AIB warns against that request. Details disclosed earlier can help an impersonator sound credible. End the conversation and use a verified bank contact to investigate the account concern before taking any action involving money.
Will the bank definitely return money after a scam?
No article can promise that outcome. Report promptly, explain the sequence accurately and follow the bank’s case-specific instructions. Keep transaction references and distinguish unauthorized activity from a payment you made after deception. Do not pay an unverified intermediary who guarantees a refund or asks for more money to recover the first loss.