Respond to a Customer With a Phishing Text

A phishing text often leaves a customer embarrassed, rushed, and unsure where trust belongs. A branch banker’s first task is to lower pressure before gathering details. Begin with a calm acknowledgment. Say, “You did the right thing by bringing this concern to us.” The sentence recognizes worry without judging a choice. A customer who feels heard often describes events in a clearer order.

Set a steady pace. Offer a private area when normal branch practice provides one. Keep your voice even. Do not open by asking why the customer replied or opened a message. Those questions sound accusatory and often lead someone to leave out details. Start with what the customer saw. Ask when the text arrived, what the message asked them to do, and whether they used a link, phone number, or reply option.

Gather only details needed for the bank’s approved fraud support route. Ask what the text claimed. Ask whether the customer entered information or took an action. Ask whether they noticed unfamiliar activity or a change in account access. Write down the customer’s description using their words. When a customer shows a phone screen, read only what they volunteer. Do not use a link or phone number inside a suspicious message.

Never ask for a password, one time code, or another secret code. A worried customer might offer one while seeking quick reassurance. Stop the disclosure gently. Say, “Please keep those details private. I will explain our approved support route for your report.” This response protects the customer from another pressured disclosure. Your conversation should not become a second risky exchange.

Separate observation from conclusion. You do not need to decide whether a message is fraudulent at the desk. You do not need to predict a review outcome. Strong words of certainty might conflict with information received later by the responsible support team. Use direct language instead. “We will help you report what happened through our official process.” Name the approved contact route used by your branch and explain who receives the report. Do not invent a review time or promise a result.

Customers sometimes ask, “Should I reply so they stop?” Give a clear boundary. Tell them not to reply through the text, use a link from the text, or call a number shown there. Then point toward the official bank contact route already available through branch procedures. The handoff matters because staff responsible for review need a consistent account of the event. Your role is to help the customer reach the official route with a clear report.

Use plain language for next steps. Avoid phrases such as someone will handle everything. A customer needs to know who receives the report, where future contact originates, and which information should stay available. Say, “I will send your report through our approved route. The support team handles further review. Please keep the text on your phone unless they provide different instructions.” This gives a next action without directing the customer through a technical procedure outside your role.

Consider a fictional practice situation. Elena visits a branch after receiving a text claiming her account needs immediate verification. She says she feels foolish because she entered her name and email address after opening a link. The banker responds, “Thank you for telling me. We will focus on the sequence and send your report to the responsible team.” Elena relaxes enough to explain when the text arrived, what the page requested, and which details she entered.

The banker asks whether Elena entered a password or one time code. Elena says no. He asks whether she noticed unfamiliar activity or difficulty signing in. Elena says she has noticed neither. He does not call her account safe. He records her answers and explains the approved fraud support route. He says, “I will send this report through our official process. Please avoid the link and phone number in the text. The support team will use contact information already associated with your bank relationship if further contact is needed.”

Elena asks whether she should delete the message. The banker does not guess which evidence the review team needs. He says, “Keep the message available for now unless the support team gives different instructions.” He explains where Elena should look for legitimate updates under the branch process. He does not tell her to trust a future text because a message uses the bank name. He repeats the official route she should use if another message causes concern.

Before sending information, review your record with the customer. Say, “I have the time you received the text, what the message requested, the information you entered, and your report of no unfamiliar activity so far. Does my record match your experience?” A short review gives the customer a chance to correct one detail before another team receives the report. For example, Elena might remember she also entered her postal code. Add the detail only after her confirmation.

Avoid a long lesson about phishing during an active concern. Focus on the next safe action. If branch policy gives you a specific official contact route, state only what you know. If you are unsure whether a detail belongs in the report, ask the responsible internal support resource. Guessing confuses the customer and weakens the handoff. A short pause to confirm the route is more useful than a confident answer based on memory.

Prepare for common questions before serving customers. Review your branch’s approved route, the information your report normally records, and the internal resource for questions outside your knowledge. Do not memorize promises about review speed or outcomes. Prepare language for uncertainty. “I understand why you want certainty. I will send your report through the official process so the responsible team receives your account.” The wording acknowledges fear without making a claim.

Practice with a colleague through a fictional scenario. One person plays a customer who received a text during lunch and feels anxious. The other plays the banker. Set a five minute timer. The banker opens with acknowledgment, asks about the message request and customer actions, avoids secret information, and explains approved routing. The colleague then asks, “Are you sure nothing will happen?” The banker responds with the prepared uncertainty language and returns to the official route.

After five minutes, review the exchange. Look for questions unrelated to the report. Look for vague promises in place of an official route. Look for a sentence treating an unreviewed text as a confirmed event. Do not score polish. Focus on whether the customer heard respect, a clear boundary, and an understandable next action. Rewrite any phrase which sounds reassuring yet claims more than the banker knows.

In a second fictional Elena conversation, she receives another suspicious text two days after her branch visit. She leaves the message untouched and calls the official branch number already in her records. When the banker answers, Elena says, “I received another message at 2:15 this afternoon. I did not use the link or number inside the text.” The banker records the timing, confirms the approved route, and sends the new report with Elena’s words before the branch closes.