Verified sender Published Aug 20, 2026

Is 86006 a real Bank of America text?

Bewary fraud research, published by Andrey Khayrullaev, founder. How we research scam patterns.

Example text from 86006

BofA Security: Did you attempt a transaction for $248.73 at TARGET on your checking account ending 1234? Reply YES if you recognize it or NO if you do not. Reply HELP for help. A real HELP reply from this code identifies BofA Security and gives 877-887-8935, instead of sending you to a link or a chat app.

REAL

86006 is a real BofA code. Bank of America leases it for FraudandClaimsBOA, checking and money market fraud and claims alerts. Real 86006 traffic asks you to confirm or deny a specific account event with YES or NO, or returns HELP with BofA Security and 877-887-8935, not a web login, app install, or request to read a one-time code to a caller.

Operated byBank of America

What real messages from 86006 do

Checks a suspicious checking account purchase. The real flow is narrow: merchant, dollar amount, account reference, then YES or NO so Bank of America can mark the activity recognized or disputed.
Checks a money market savings account transaction or fraud claim item. The text is about the account event, not a full identity interview inside SMS.
Supports Bank of America's FraudandClaimsBOA campaign. That matters because 86006 is not a prize code, a collections code, a delivery code, or a random security newsletter.
Replies to HELP with BofA Security and 877-887-8935. A real help path gives the bank's callback route for this alert channel, not a fresh domain, shortened URL, Telegram handle, or payment app instruction.
Sends account-protection prompts when Bank of America needs a quick decision on activity. A normal message stays inside the fraud decision: recognize it, deny it, or get help through the code's published help response.

How a fake 86006 differs

The text says it is a 'Bank of America 86006 alert' but it arrives from a 10-digit phone number, an email-to-text sender, an iMessage account, or a group chat. Real replies to this short code sit in the 86006 thread. The fake sender is trying to borrow the code's reputation while avoiding the short-code channel.
It adds a bank-looking link after the YES or NO question. Watch shapes like bankofamerica-secure[.]com, bofa-alerts[.]com, boa-86006[.]com, or a shortened URL that opens a login page. The real 86006 job is to capture a fraud decision by SMS, not to make you sign in through a new domain.
It changes the reply language. Real 86006 traffic is built around YES, NO, and HELP. A fake may ask you to reply 1, Y, CANCEL, RELEASE, or VERIFY, then use that reply to start a second script with a caller or a link.
It asks for the Online Banking ID, password, debit card PIN, full card number, Social Security number, or the one-time code Bank of America just sent. That is not needed to answer whether you made a $248.73 Target purchase on a checking account ending in four digits.
It turns a NO reply into a phone call from a fake fraud agent. The caller may say they are 'finishing the 86006 case' and ask you to read back a security code, approve a device, or remove a block. That code is for account access or money movement, not for canceling the text alert.
It swaps the simple fraud question for a money-moving instruction. Lines like 'transfer funds to a safe checking wallet,' 'reverse the Zelle hold here,' or 'send a test payment to release the block' do not match the 86006 structure. The real alert asks you to confirm or deny activity. It does not ask you to move money to prove ownership.
The HELP behavior is wrong. A real HELP response identifies BofA Security and gives 877-887-8935. A fake thread may return no HELP response, a different number, a live-chat link, a WhatsApp contact, or a message saying HELP is disabled because the account is locked.
The message uses account details as bait, then demands a wider unlock. Scammers can know a name, a last four, or a recent merchant from a breach or receipt. The tell is the jump from one checking or money market event to a full login, device reset, external transfer, or caller-controlled verification.

What to do now

Classify the message by its job. A clean 86006 alert asks one question about one checking or money market event and accepts YES or NO. Reply YES only when the merchant, amount, and account ending match your own activity. Reply NO only when they do not. Any link, caller handoff, or code-reading request breaks the real 86006 pattern.
Use HELP to test the channel. Text HELP to 86006 from the same thread. The expected help response identifies BofA Security and gives 877-887-8935. Use that number from the HELP response for the 86006 alert, not a number pasted into a message that is already asking for credentials or a callback.
Match the alert against your Bank of America account record before giving a fraud decision. Open your normal Bank of America app or your own saved bookmark, then look for the checking or money market transaction named in the text. The decision should map to a real posted or pending item, not to a vague 'security hold' with no merchant, no amount, and no account reference.
Report impersonations to Bank of America's published abuse mailbox. Forward the suspicious text or screenshot to abuse@bankofamerica.com, especially when it contains a link, asks for an Online Banking ID, asks for a one-time code, or turns the 86006 alert into a phone call. Include the sender that actually appeared on your phone, because a fake often claims 86006 inside the message body while sending from somewhere else.
Use Bank of America's suspicious-communications page for the current reporting path: https://web.bankofamerica.com/en/security/report-suspicious-activity. Follow that page when the message includes a fake login page, a spoofed callback number, or a thread that says HELP is unavailable. Do not replace the bank's published route with a number from the suspicious text.
If you gave a password, one-time code, card PIN, or approval to a caller, call 877-887-8935 or the number on the back of your Bank of America card. Say this exact issue: 86006 fraud-alert impersonation. Ask them to check Online Banking access, new devices, Zelle recipients, pending transfers, debit-card status, and any fraud or claims notes tied to the checking or money market account.

Got a text you are unsure about?

Paste it here. Bewary reads it and tells you straight, free.

Sources

What this page checks against.