A fake banking app copies the look of the real one. The goal is simple. It wants your username, your password, and sometimes the texted code that proves you are you. Four quick checks can catch most of the trouble before you type anything.

  1. Source: Did you get the app from an official app store, or from a link on your bank's own website?
  2. Message trail: Did an unexpected text, email, or direct message point you to the download or the login page?
Hands resting beside a lined notepad on a wooden kitchen table, with a phone lying face down nearby in soft morning light.
A short checklist, read before logging in, can help you catch a counterfeit banking app.
  1. Permissions: Does the app ask for phone access that has nothing to do with banking?
  2. Error screens: Does it show an error right after you sign in?

How fake banking apps operate

The FBI Internet Crime Complaint Center warned in 2020 that cyber actors were expected to target new mobile banking customers with banking trojans and fake banking apps. The fake apps are built to resemble the real apps of major financial institutions. Their job is to trick users into entering login credentials.

A banking trojan hides inside something else, such as a game or a simple tool. It sits quietly until you open your real banking app. Then it throws up a false login page on top of the real one. You type your details into the overlay. The trojan then hands you to the genuine login page, so the theft is easy to miss.

A standalone fake app works a little differently. It may show an error message right after you try to sign in. By then your details may already be gone. The FBI also noted that fake apps can use phone permission requests to obtain and bypass the security codes texted to users.

Choosing where to get a banking app

The FBI's advice is plain. Install banking apps only from trusted sources, meaning official app stores or your bank's own website. Most major US banks link to their mobile app from their homepage. Start there rather than searching blind.

App stores are run by private companies that vet apps for malicious content. That is a useful filter. It is not a promise that every listing is safe. The FBI alert does not explain how to verify an app's developer, so the link on your bank's site is the check you can actually lean on.

Treat unexpected messages with suspicion. The ABA Foundation and the FTC, in an infographic covered by the ABA Banking Journal, advise against clicking a link in an unexpected email, text, or direct message that asks for a login, a PIN, or money. Contact the institution through a verified channel instead.

Red flags in messages and software

Banks never call, text, or email to ask for personal information. They also never tell you to send money to anyone, including yourself. If a message does either, assume it is not your bank. That one rule covers a lot of scams.

Impersonation reaches past banks. The Consumer Financial Protection Bureau warns that scammers pretend to be the CFPB itself, and it publishes warning signs of a CFPB imposter scam. A message that claims to be from a federal agency and asks for money or information deserves the same suspicion as one from a fake bank.

Polished writing is no longer a sign of safety. CNET reports that scammers use large language models to write highly personalized phishing emails and texts, and machine learning to make voice clones. A message with perfect grammar, or one that sounds like someone you know, can still be fake. CNET also notes that AI detection tools can be unreliable, so lean on the other checks instead.

Scam terms and the scale of the problem

The scale is large. CNET cites an estimate that online scams cost Americans nearly $119 billion a year, and says robocall and text scams hit a six-year high in 2025. The app-specific numbers are older. The FBI said security researchers reported nearly 65,000 fake apps on major app stores in 2018. Current counts are not in the sources.

The CFPB defines four terms worth knowing:

  • Imposter scams: a criminal pretends to be someone you trust to get money or information.
  • Phishing: deceptive messages meant to pull out personal details or get you to click.
  • Spoofing: faking who a call, email, or website appears to come from.
  • Identity theft: using another person's personal information without permission.

One more habit matters. The FBI alert said surveys since 2016 found that a majority of users do not turn on two-factor authentication when prompted, most often because it is inconvenient. Turning it on when your bank offers it costs a few seconds.

If something feels wrong

Stop and contact your bank through a channel you trust. The ABA Foundation and FTC guidance suggests the bank's mobile app or the number on the back of your debit card. Do not use a number or a support link from the suspicious app or message.

Tell the bank what happened, including whether you entered a password or sent money. The sources here do not lay out further recovery steps or a consumer's right to get money back after an unauthorized transfer. So ask the bank directly what it can do, and ask it about next steps.

Then run the checklist again on any app you plan to keep. Where did it come from? What does it ask for? What happens when you log in? Those three questions are quick, and they catch the tricks the FBI describes.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.