Truist Phishing Email Scams in 2026: How to Spot Them

Truist phishing in 2026: the short answer

Fake Truist emails, texts and alerts are still a live risk in 2026. Truist tells customers not to respond, click links or give passwords and PINs to suspicious messages that claim to be from the bank.[6] If you are unsure, call 844-4TRUIST (844-487-8478) or the number on the back of your card, and forward the message to emailabuse@truist.com.[6]

Phishing as a whole has grown more costly. The FBI's Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints in 2025, with reported losses of 215.8 million dollars, up from 70 million dollars in 2024.[7] The 2021 case in our original report, a fake Truist banking app that hid a remote access trojan, shows how far these scams can go.

Timeline: Truist phishing and phishing losses

What changed since 2021

The 2021 attack was a targeted one. It offered a 62 million dollar loan to a single company and asked staff to install a fake Truist app, as the original report below describes.[1] Most Truist scams people search for today are mass emails and texts sent to ordinary customers.

Truist now runs its own reporting route. It asks people to forward suspicious emails, numbers or screenshots to emailabuse@truist.com and to call the bank when unsure.[6] Its fraud pages also link to the FBI's IC3 for reporting crime.[6]

The losses tell the rest. Phishing complaint counts fell from 298,878 in 2023 to 191,561 in 2025, but reported losses rose more than tenfold over the same period.[7] Fewer victims are losing much more money each, which suggests better targeted scams. In total, losses reported to IC3 in 2025 passed 20 billion dollars.[7]

Common Truist scams to watch for (our analysis)

The patterns below are our analysis of fake Truist messages and of the 2021 case. They are not an official Truist list.

• Fake Truist alerts. Emails or texts that say your account is locked or a payment was blocked and ask you to sign in through a link.
• Fake fraud department calls. A caller who claims to be from Truist and asks for a code, PIN or password, which Truist says it will not request.[6]
• Fake apps and downloads. A link to install a special Truist app, as in the 2021 SecureBank app that carried a remote access trojan.[1][3]
• Loan and business offers. Large loans or deals that need you to register through a portal you have never used.[1]
• Look-alike bank names. Messages that use BB&T or other familiar bank names to seem trustworthy, as the 2021 campaign did with several banks.[4]

What to do with a suspicious Truist message

1. Do not click. Do not open links or attachments and do not reply. Truist asks customers not to respond to suspicious messages.[6]

2. Call Truist. Check the message by calling 844-4TRUIST (844-487-8478) or the number on the back of your card, not a number in the message.[6]

3. Forward the message. Send the email, the phone number or a screenshot to emailabuse@truist.com.[6]

4. Delete it. After forwarding, delete the message so you do not open it by mistake later.[6]

5. Secure your account. If you already typed a password or code, change your password from the official app or site, and ask Truist to review recent activity. Run a security scan if you installed anything, using our malware removal guides.

6. Report to IC3. If you lost money, report it to the FBI's Internet Crime Complaint Center.[6][7] Our guide on how to report phishing lists other places to send fakes.

What is still unknown

• How many of the 2025 phishing complaints involved Truist. The IC3 report does not break losses down by bank.[7]
• Who ran the 2021 fake Truist app campaign. We found no public attribution.
• Whether the 2021 portal domains are still in use. We found no newer report on them as of 2026.

Our original 2021 report

The text below is our report as first published in 2021. We keep it unchanged for the record; the sections above bring it up to date.

The FBI has released[1] a Private Industry Notification (PIN) stating that their Cyber Division has detected a new phishing campaign roaming on the internet. This time, threat actors are imitating Truist Financial Corporation,[2] an American bank holding company, which is the sixth-largest in the US.

The PIN contained a brief summary of one identified spear-phishing attempt that in February 2021 targeted a US-based renewable energy company. During the campaign, threat actors have sent emails containing two .pdf files and hyperlinks to a spoofed website to the victim.

The target of this phishing attack was urged to download an application that looked like a legitimate app from Tuist bank, called Truist Financial SecureBank App. That was allegedly required to complete registration and receive their loan of $62 million. The email also contained a username and password to log in to the fake tool. In reality, a remote access trojan, more popularly known as RAT, in the cyber community, was hidden within the downloaded impersonated banking app.

Functions and capabilities of the distributed malware

Samples of the RAT delivered through the spear-phishing campaign were provided to VirusTotal, a portal for scanning possibly malicious files with the most popular antivirus engines. The results were staggering as none of the AV tools flagged the setup.exe file as malicious.

That suggests that no matter what cybersecurity software is installed on a device, it would miss it, and the infection could run uninterruptedly in the background. VirusTotal has issued a list[3] of what the impersonated Truist Financial SecureBank App could do on an infected computer:

• Take screenshots or make videos using a webcam,
• manipulate system registry by altering values and entries,
• download additional malware,
• steal personal files,
• log keystrokes,
• etc.

Most of these functions are linked to information stealing. By taking screenshots and logging keystrokes, the evildoers might obtain your private information (address, phone number, SSN, etc.) or gain access to the emails, social media profiles, bank accounts, and alike.

More attacks may lay ahead as the Truist bank wasn't the only one impersonated

The phishing emails sent out during the campaign contained hyperlinks to secureportal.online. Threat actors urged their victims to visit this page to download the malicious Truist Financial SecureBank App. According to research,[4] the Truist bank wasn't the only spoofed one.

Cumberland Private, MayBank, and FNB America were also being mimicked. Such spear-phishing attacks could return, so everyone using either of these four UK and US financial institutions should be aware of this and be extra careful. Since reliable antivirus software doesn't seem to be enough to stop this fake Windows application, people need to learn how to spot a phishing email to avoid becoming the next cyberattack victim.

One of the most notable peculiarities of such a message is that it creates a sense of urgency. It might be an email appearing to be from your bank, coworkers, hospital, etc., urging you to click a hyperlink or download an attached file. If you ever spot something suspicious, please call the person/institution and ask if they've sent the email to you.

Please don't rush, as opening the attachment or clicking on a link might get you in way more trouble than double-checking its origins. Other features[5] might include misspelled domain names, grammatical errors, requests for private details over the email, and so on.

Related guides on 2-Spyware

• How to report phishing
• Check whether your email appeared in a leak
• Virus and malware removal guides
• Recent data breaches