Is that Bank of America text a scam?

How to spot the Bank of America scam

• The link is not bankofamerica.com. Lookalikes lean on the abbreviation, bofa-secure-alerts.com or bofa-alerts.net, because "bofa" reads as familiar. Judge the domain immediately before the first single slash and ignore everything in front of it.
• You are asked to read back a one-time code. That code is the second half of your login. Anyone who wants it is asking you to finish a sign-in that they started and you did not.
• A charge you do not recognise, for an odd but plausible amount. The number is chosen to be worth panicking about and small enough to be believable.
• A call follows the text, from the "fraud department", often within minutes. The text was there to make the call expected. Caller ID showing the bank's own number proves nothing, because it is trivially spoofed.
• The caller asks you to move money to a "safe" or "protected" account to keep it away from the fraud. No bank does this. Your account is already the safe account, and this single instruction is the point of the whole operation.
• You are asked to stay on the line while you act, or to keep the matter to yourself. Isolation is a technique: it stops you ringing the bank separately or asking someone in the room.
• The message arrives about an account you do not hold with them. These campaigns text numbers in bulk, so a Bank of America alert to a non-customer is the tell.

What to do now

1. Do not tap the link and do not ring any number printed in the text. Use the number on the back of your card or on your statement, which is exactly what Bank of America tells customers to do if they have responded to a suspicious message.
2. Check the account in the app you already have installed. A genuine hold or declined charge appears there.
3. Lock your debit card in the app if you are unsure. It blocks unauthorised transactions and you can unlock it once you have checked.
4. Report the message: forward suspicious emails or texts using Bank of America's name to abuse@bofa.com, and forward the text to your carrier at 7726 (SPAM). Including the number it came from is what makes the report actionable.
5. If you shared a code or moved money, call the fraud line straight away: 800-432-1000 for debit, ATM, cheque and Zelle, or 800-732-9194 for a consumer credit card. From outside the US, collect on 1-315-724-4022.
6. Write down the times, the number that called and what you were told before the details fade. That record is what a disputed-transfer investigation runs on.