The text shows up looking like a real fraud alert. It names a dollar amount specific enough to feel real ($487.32 at a store you don’t shop at), tells you to reply YES to confirm or NO to deny, and gives a callback number if you say NO. The number is the scammer’s call center.
What makes this one work is that you’re being handed the script. You don’t have to figure out what’s wrong. The text told you what’s wrong and what to do about it. By the time you’re on the phone with the fraud department, you’ve already accepted their version of reality, and the next thing they ask for (your online banking password, a verification code, your card number to reissue) feels like cooperation.
Your real bank does send fraud alerts, but the safe move never changes. Hang up. Call the number on the back of your card.