The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Bank of America email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Bank of America email says your account is limited, then asks you to confirm your details.
Bank of America’s Better Money Habits page shows a sample suspicious email and marks what is wrong with it. The email below is invented, but it makes the same mistakes, and each number is one of the signs that page lists.
Example
Dear account holder,
Your account has been limited because we could not verify your recent activity.
Confirm your full name, date of birth and card number within 24 hours.
Do not call the number on your card. Reply to this email with the details.
The button says bankofamerica.com/verify
The sender's address is not the bank's.
The name says Bank of America, but the part after the @ belongs to someone else. The bank's page lists an incorrect company name or email address as a sign of phishing.
A greeting that does not use your name.
The bank's page lists an email that doesn't use your name as a sign.
A request to confirm personal information.
The bank's page lists a request to verify or provide personal information as a sign.
A line that tells you not to call.
The bank's page lists a message that tells you not to call as a sign.
A button that says bankofamerica.com and goes somewhere else.
The bank's page lists unusual or altered URLs as a sign, and says that even a link that looks legitimate could be a phishing link in disguise.
From Bank of America: How to Spot and Avoid Phishing Scams, read 7 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “Bank of America” in front of an address. The part to read is the domain, after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. The bank’s own security pages are at web.bankofamerica.com, and the owner of that address is bankofamerica.com. The bank also gives abuse@bofa.com as the address to report to, so bofa.com belongs to it too.
Read the domain from the right
web.bankofamerica.com
From Bank of AmericaOwned by bankofamerica.com. This is the address of the bank's own security pages.
bankofamerica.com.account-verify.example
Not from Bank of AmericaOwned by account-verify.example. bankofamerica.com is only a label in front of it.
bankofamerica-secure-desk.example
Not from Bank of AmericaOwned by bankofamerica-secure-desk.example. The name has Bank of America in it, but the owner is someone else.
From Bank of America: Report Suspicious Activity, read 7 November 2026.
Bank of America lists the signs of a phishing email, and the example above shows five of them.
The bank’s page also lists signs that need no example: email subject lines that demand urgent or immediate action, odd or unfamiliar senders, and unexpected requests. The five below are the ones from its sample suspicious email.
| Sign | What Bank of America's page says | In the example email |
|---|---|---|
| The sender | What Bank of America's page says"Uses incorrect company name or email address." | In the example emailThe domain after the @ is not the bank's. |
| The greeting | What Bank of America's page says"Doesn't use your name." | In the example emailIt opens with "Dear account holder,". |
| A request for details | What Bank of America's page says"Asks you to verify or provide personal information." | In the example emailIt asks for your full name, date of birth and card number. |
| A warning against calling | What Bank of America's page says"Tells you not to call." | In the example emailIt says not to call the number on your card. |
| The link | What Bank of America's page says"Includes unusual URLs or ones that appear to be altered." | In the example emailA button that says bankofamerica.com and goes somewhere else. |
From Bank of America: How to Spot and Avoid Phishing Scams, read 7 November 2026.
Bank of America's advice for any fake alert is stop, verify on a number you trust, then report.
The bank’s scam page says scam details change but red flags stay the same: someone pretending to be a bank employee, a friend or a family member, pressure to act fast, threats of legal action, coaching on what to say, and unusual payment methods such as a wire transfer, gift cards, cryptocurrency or prepaid debit cards. It adds that scammers may tell you not to trust Bank of America employees or to ignore warning messages.
What to do with a fake alert
- Stop
Trust your instincts and don't engage.
The bank's scam page says to stop, and not to respond.
- Verify
Call a trusted and known number.
Like the one on your card or statement. For a website, type the URL yourself or use the official app.
- Report
Forward it to abuse@bofa.com.
The bank says to forward suspicious emails or texts that use its name, and a text to 7726 (SPAM).
From Bank of America: Scam Prevention, read 7 November 2026.
From Bank of America: Report Suspicious Activity, read 7 November 2026.
Five steps tell you whether a Bank of America email is real without clicking anything.
- Do not click any links, reply to the message or download any attachments. The bank says that even if a link looks legitimate, it could be a phishing link in disguise.
- Read the sender’s address from the right, as in the picture above, and look at the greeting and the wording against the bank’s list of signs.
- Go to the bank’s website by entering its correct URL directly in your browser, or use its official app. To talk to someone, call the number on your card or bank statement.
- Paste the email into the checker at the top of this page for a second read.
- Forward the email to abuse@bofa.com and then delete it, as the bank says. A suspicious text goes to your phone carrier at 7726. In Gmail you can also choose More next to Reply, then Report phishing.
Steps from Bank of America: How to Spot and Avoid Phishing Scams, read 7 November 2026.
Steps from Gmail Help: Avoid & report phishing emails, read 7 November 2026.
If you responded, Bank of America says to call the number on your card or statement.
The bank’s report page says that if you responded to a suspicious call, text or email, you should call the number on your card or bank statement. It does not list further steps. For a link or file you opened, the FTC says to update your computer’s security software, run a scan and remove anything it finds. For details you shared, IdentityTheft.gov lists the steps that match what you lost.
What to do depends on what you did
You only read it.
Forward it to abuse@bofa.com and then delete it.
You clicked a link or opened an attachment.
Update your computer's security software, run a scan and remove anything it identifies as a problem.
You replied, or entered details.
Call the number on your card or bank statement. Then follow the steps at IdentityTheft.gov for what you shared.
From Bank of America: Report Suspicious Activity, read 7 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
The same checks work on other bank emails.
An account alert can borrow the name of any bank. The guide to fake Chase emails covers a fraud alert that asks you to move money, and the guide to fake Wells Fargo emails covers a support tool that shares your screen. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real Bank of America email from a fake one?
Bank of America's page on phishing lists these signs: a subject line that demands urgent action, an odd or unfamiliar sender, an incorrect company name or email address, no use of your name, misspelled or awkward wording, a request to verify personal information, a message that tells you not to call, and unusual or altered URLs.
Where do I forward a fake Bank of America email or text?
Bank of America says to forward suspicious emails or texts that use its name to abuse@bofa.com, and for a customer to delete the email afterward. It also says to forward a suspicious text message to your cell phone provider at 7726 (SPAM).
What if the email tells me not to call?
Bank of America lists a message that tells you not to call as a sign of a phishing email. Its scam page says scammers may tell you not to trust Bank of America employees, to ignore warning messages, or coach you on what to say.
What does Bank of America say to do with a fake alert?
Its scam page says to trust your instincts and not engage, then to call a trusted and known number, like the one on your card or statement. Its phishing page says to go to a company's website by entering its correct URL directly in your browser, or to use the company's official app.
What are the red flags of a bank scam?
Bank of America says scam details change but red flags stay the same: someone pretending to be a bank employee, a friend or a family member, pressure to act fast, threats of legal action, coaching on what to say, and unusual payment methods such as a wire transfer, gift cards, cryptocurrency or prepaid debit cards.
What should I do if I responded to a suspicious message?
Bank of America says that if you responded to a suspicious call, text or email, you should call the number on your card or bank statement. If something may have downloaded, the FTC says to update your computer's security software and run a scan.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- Bank of America: Report Suspicious Activity
- Bank of America: How to Spot and Avoid Phishing Scams
- Bank of America: Scam Prevention
- FTC Consumer Advice: What To Do if You Were Scammed
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails