Scammers Fake Bank Fraud Alerts. Here's How to Set Up Real Ones

On June 15, 2026, the Federal Trade Commission said people reported losing nearly $1 billion to business impersonators in 2025, with bank impersonators accounting for the highest losses in that group, and warned that some of the costliest scams begin with a fake security alert. In late September, a University of Florida extension agent also warned about "email bombing," where a flood of sign-up emails hides a real bank alert. For you, that means checking that your card's own alerts reach you fast, on a channel a scammer can't bury, and that you can tell them from fakes. Three settings do most of the work: a purchase alert with the lowest threshold, alerts for online and foreign charges, and security alerts for account changes.

Key takeaways

Set a purchase alert at $0 or the lowest amount your issuer allows. Visa's June 2026 guidance for merchants says card-testing charges are often under $10, and Wells Fargo's alert sends nothing for a charge equal to or below the amount you set.
Card-not-present and foreign-transaction alerts flag charges that need only your card number, not the card. American Express and U.S. Bank list both as options you can turn on.
Security alerts about address, email, phone, password or digital wallet changes are often sent automatically, but U.S. Bank and Bank of America send them to your email by default. Adding text or app notifications keeps them out of a flooded inbox.
For debit cards, Regulation E limits your loss to $50 if you report a lost or stolen card within two business days of learning about it, and up to $500 after that. On a consumer credit card, liability is capped at $50 with no reporting deadline, and is $0 when only the card number was used.
The FTC says no caller from your bank's fraud department will ever ask for a verification code. If an alert or caller says there's fraud, call the number on the back of your card or open the issuer's app yourself.

What it means for you

Debit card holders: fraud takes money straight out of checking, and how much you can lose depends on how fast you report. A $0 purchase alert matters most for you.
Credit card holders: your legal exposure is capped at $50, and $0 for card-not-present fraud. Alerts still matter because the formal billing-error process needs a written notice within 60 days of the statement, and unnoticed fraud uses up your available credit.
People whose card data was in a breach: stolen numbers are often tested with small charges first. Alerts 1 and 2 are aimed at this pattern.
Joint account holders and families: at Wells Fargo, each debit cardholder on a shared account has a separate card number and must sign up for alerts individually. Check everyone's settings.

Alert 1: every purchase, from $0

A purchase alert (also called a transaction alert) tells you each time a charge is approved on your card. Most large issuers let you choose a minimum amount. Capital One's instant purchase notifications let you choose a dollar minimum, and its own tip is that $0 tracks every purchase. Chase says its transaction alerts can cover every purchase or only charges over an amount you choose, giving $20 as an example. Bank of America offers alerts when a debit card payment over a set amount is made and when a credit card charge posts.

The threshold is the setting to check, because the first fraudulent charges are often the smallest. Visa's June 2026 guidance to merchants on enumeration (automated guessing and testing of card details) says attack transactions are often less than $10, and that smaller charges are less likely to attract attention. A $25 threshold misses every one of those tests. Wells Fargo's debit alert FAQ shows how literal the cutoff is: with the amount set at $5.00, you get an alert only for a charge of $5.01 or more.

Where a purchase alert falls short

Timing varies: Wells Fargo says alerts typically arrive within minutes, while Chase's Account Alerts page says alerts are generally processed at the end of each business day, though some go out right after a transaction. Capital One says notifications may be delayed or not delivered, and that email and app alerts aren't available on its retail partner cards. Wells Fargo adds that an alert can fail when the merchant sends incomplete information, so alerts don't replace reading your statement.

If a $0 alert on an everyday card is more than you will read, keep it on the riskiest cards, such as a debit card linked to checking, and use Alert 2 for the rest.

Alert 2: online and foreign charges

A card-not-present transaction is one where the card itself is not presented: an online, phone or mail order using the card number, expiration date and security code. A stolen card number can be used this way without the physical card. Some issuers let you set an alert for exactly these charges:

Issuer	Online or card-not-present alert	Foreign transaction alert	Other options named by the issuer
American Express	Yes, for online or phone charges	Yes	Cash advances, irregular activity, purchases over a set amount (example: $100)
U.S. Bank	Yes ("purchases made without a physical card")	Yes	ATM cash withdrawals and gas station purchases, grouped as higher fraud risk
Wells Fargo (debit)	Not listed on the pages reviewed	Its FAQ describes alerts for purchases from an international location	Card activity over an amount you set
Capital One, Chase	Not listed on the pages reviewed	Not listed on the pages reviewed	Purchase alerts with a chosen minimum ($0 at Capital One)

Sources: American Express fraud alerts guide (updated August 26, 2026), U.S. Bank account notifications and the Wells Fargo, Capital One and Chase pages cited above, all checked October 5, 2026. Alert menus change and can differ by card, so the list inside your app is the final word.

These alerts cover what a thief with only your card number can do, without pinging you for every coffee, so turn them on after any breach notice that includes card numbers. Expect some false alarms: Wells Fargo notes that a merchant based abroad can sell online, by mail or by phone, so a foreign-transaction alert can fire for a purchase made from home.

Alert 3: changes to your account

The third alert covers someone getting into your account rather than just using your card number. U.S. Bank says it sends security alerts automatically when it receives a request to change your address, email, phone number, username, password or PIN, and when your login is suspended after repeated wrong passwords. Bank of America sends automatic alerts for unusual activity and changes such as a new address. Wells Fargo says it may notify you when your debit card is added to a digital wallet, and its alerts page offers additional security alerts for sign-on activity.

Each of those events can come before card fraud. A thief who changes your email or phone number can redirect the alerts from Alerts 1 and 2. A card added to a phone wallet you don't own lets someone pay in stores without the plastic. An alert about either is a reason to call your issuer at once, not to wait for a charge.

Why the delivery channel matters

Many of these security alerts are on by default, so the review is about where they go. U.S. Bank and Bank of America both send them to your email unless you add text or app delivery, and Bank of America recommends turning on app notifications. Email is the channel an attacker can flood: the University of Florida's extension service described email bombing on September 29, 2026 as a flood of sign-ups for legitimate newsletters and mailing lists that can hide a bank alert among hundreds or thousands of unwanted messages. App push notifications or texts give you a second route the flood doesn't reach.

Your liability once you report

An alert only helps if you act on it, and the deadlines that limit your loss differ by card type. The table summarizes the federal rules; it is general information, not legal advice, and your card agreement may give you more protection.

Situation	Debit card (Regulation E)	Credit card (Regulation Z)
Card lost or stolen, reported before any use	$0	$0
Card lost or stolen, reported within 2 business days of learning of it	Up to the lesser of $50 or the amount taken before you reported	Up to the lesser of $50 or the amount charged before you reported
Card lost or stolen, reported later	Up to $500, if the bank shows the later charges wouldn't have happened with a timely report	Still capped at $50
Card not lost; only the number was used	$0 if reported within 60 days after the statement showing the charge is sent	$0; no liability can be imposed when the card itself wasn't presented
Unauthorized charge on a statement, not reported within 60 days	Possibly unlimited for charges after day 60 that a timely report would have prevented	The $50 cap still applies (it has no reporting deadline), but the formal billing-error process requires a written notice received within 60 days of the first statement showing the error

Under 12 CFR 1005.6, the two business days don't count the day you learn of the loss and run to 11:59 p.m., not the bank's closing time. Notice can be in person, by phone or in writing, and the deadlines must be extended for reasons such as long travel or a hospital stay. The CFPB applies the same two-day window to a stolen PIN or security code.

For credit cards, 12 CFR 1026.12(b) sets the $50 cap without a reporting deadline, and its official interpretation bars any liability when someone orders by phone or online using only your account number and the details printed on the card. Different terms can apply to business cards when an organization has 10 or more cards issued for its employees. Billing-error notices under 12 CFR 1026.13 must reach the issuer's billing-error address in writing. The FTC advises following any phone report with a letter, for both card types.

Zero-liability promises and their limits

Card networks and issuers often go further than the law, but these are voluntary policies with conditions, and the federal rules above remain the legal floor. Visa's Zero Liability Policy says you won't be held responsible for unauthorized charges on most Visa credit and debit cards, and requires issuers to replace stolen funds within five business days of notification. It does not apply to certain commercial cards, anonymous prepaid cards or transactions not processed by Visa, and Visa says replacement funds are provisional and can be limited or withheld for gross negligence, fraud or a delay in reporting.

Mastercard's Zero Liability protection covers store, phone, online, mobile and ATM transactions, provided you used reasonable care to protect your card and promptly reported its loss or theft. It excludes certain commercial cards and unregistered prepaid cards, such as gift cards. Citi offers $0 liability on unauthorized charges for select consumer credit card accounts. Because both network policies depend on prompt reporting, a quick report matters even with a zero-liability card.

Illustrative example: one stolen debit card

Someone steals a wallet on a Monday. The thief uses the debit card for $40 and then $460 on Tuesday, and $700 on Thursday: $1,200 in total, which the checking balance covers. These are hypothetical figures; business days run Monday to Friday.

With a $0 purchase alert: the owner hasn't noticed the wallet is gone, but the alert for the $40 charge arrives Tuesday morning. The owner calls within minutes, before the $460 charge. Liability is the lesser of $50 or the $40 charged before notice: $40 at most, and the later charges are declined.
Without alerts, reported late: the owner notices the missing wallet on Monday but waits until Friday to call. The two business days end at 11:59 p.m. Wednesday. Liability is $50 for the $500 taken within that window plus the $700 taken Thursday, which is $750, capped at $500, provided the bank shows the Thursday charge wouldn't have happened with a timely report.
Same facts on a credit card: liability is $50 at most in both cases ($40 in the first), and no money leaves a bank account.

The legal difference between the two debit cases is up to $460 ($500 minus $40). The practical difference is larger: in the second case $1,200 left the checking account, and getting the rest back depends on the bank's investigation, which generally has 10 business days and can run to 90 days for point-of-sale debit purchases.

Real alert or a fake one?

The FTC's June 15, 2026 release put imposter scams at $3.5 billion in reported 2025 losses, nearly one in three fraud reports, and singled out alerts that impersonate banks:

"Some of the costliest impersonation scams start with a fake security alert, often from a bank." (FTC, June 15, 2026)

Fake alerts copy the format of real ones, so the reliable check is the route you use to respond. The FTC's consumer guidance lists the signs that a supposed fraud warning is a scam:

A request for a verification code. The FTC says no caller from a bank's fraud department will ever ask for one. Sharing it lets a scammer prove they are you.
An offer to "protect" your money by moving it. The FTC says this is always a scam, and that if you are scammed into moving money out of a bank account, you won't be protected.
A number or link supplied in the message. Call the number on the back of your card or on your statement, or open the issuer's app yourself.

Some real alerts do ask for a reply: Capital One says it texts about suspicious activity, and that if you reply "no" it can place a block on your card. Confirming or denying a charge that way is different from calling a number, tapping a link or giving a code. When in doubt, close the message and use the app.

Frequently asked questions

Is a credit bureau fraud alert the same as my card's fraud alert?

No. A credit bureau fraud alert sits on your credit report and tells lenders to verify your identity before opening new credit in your name; it does nothing about charges on existing cards. The FTC lists three kinds: an initial alert for one year, an extended alert for seven years that requires an FTC identity theft report or police report, and an active-duty alert for one year. You place any of them with one bureau, which must tell the other two.

Do joint account holders get alerts for their own debit cards?

Not automatically at every bank. Wells Fargo says joint account holders and authorized signers have their own debit card numbers and must sign up for card activity alerts individually. Chase says alerts must be set up separately for each account. Check the settings for every card on a shared account.

Will my alerts carry over to a replacement card?

Not always. Wells Fargo says that if your card number changes after a replacement, it will do its best to move existing card activity alerts to the new number, and suggests checking your subscriptions in its Manage Alerts page. After any reissue, open your alert settings and confirm the new card is listed.

How long does a bank have to investigate a debit card fraud claim?

Generally 10 business days, or 20 if the account has been open less than 30 days, according to the CFPB. If it needs longer, it must usually give a provisional credit, minus up to $50, while it investigates. Investigations can then run to 45 days, or 90 days for point-of-sale debit card purchases, foreign transactions and transactions within 30 days of opening the account.

Do alerts cost anything?

The issuers reviewed here don't charge for them. Bank of America says it does not charge for alerts, but your mobile carrier's message and data rates may apply to texts. App push notifications avoid carrier text charges, though they need the issuer's app and a device that supports them.

A 10-minute alert checkup

Open each card's app or website and find the alerts menu (often under Profile, Settings or Alerts).
Set the purchase alert to $0, or the lowest amount allowed, on your debit card and on any card you rarely use.
Turn on card-not-present (online and phone) and foreign-transaction alerts where your issuer offers them.
Find the security alerts and add app push or text delivery alongside email.
Confirm the phone number and email on file are current, and that joint holders and authorized users have their own alerts set up.
Save the number on the back of each card in your phone contacts, so you never need to use a number from a message.
After any card replacement, repeat steps 2 to 4 for the new card.