How to tell if a bank email is fake

By the Soporte Técnico Panamá team · Updated June 2026

In Panama, as everywhere, emails and messages impersonating your bank have become one of the most common scams — and for the international and expat community here, juggling accounts at home and locally, they can be especially confusing. They arrive with your bank's logo, colours and tone, and they play on something deeply human: the fear that something is wrong with your money. The good news is that almost all of these tricks leave fingerprints, and with a couple of simple habits you can catch them before they catch you. In this guide we explain the tell-tale signs, give you a checker to inspect a suspicious email's headers — running entirely in your browser, so nothing leaves your device — and tell you what to do if you've already handed over your details.

Why do these emails fool so many people?

Because they're built to make you act with your heart before your head. Scammers copy your bank's logo pixel by pixel, use the same colours and a formal tone identical to a genuine email, and sometimes even include your name or the last digits of a supposed card — details that can come from data leaks to seem credible. But their real weapon is emotional: they create urgency or fear that pushes you to click without thinking. "We detected unauthorised access", "your account will be locked in 24 hours", "verify your identity now or lose access". The moment you feel that rush and that dread is exactly the moment to slow down, because that hasty reaction is precisely what the scammer needs from you.

The signs that give a fake away

Once you know where to look, fake emails get much easier to spot. These are the most useful signs:

• Urgency or threat. Messages pressuring you to act "immediately" or within "24 hours" aim to override your judgement with fear. A real bank gives reasonable deadlines and warns through several channels.
• They ask for confidential details. If you're asked to "verify" or "confirm" your password, PIN, card code or a code you received, it's a scam. Your bank never asks for that.
• The real sender doesn't add up. Don't trust the display name ("Your Bank"). Look at the full address: if the domain is odd, carries extra words, or is a free Gmail or Hotmail account, be suspicious.
• The link leads to another domain. Hover over the link without clicking and read the real address. The true domain sits just before the first slash; if it isn't exactly your bank's, it's fake.
• Errors or odd phrasing. Spelling mistakes or strange wording are a clue, though they're getting rarer.
• It arrives through an unusual channel. If your bank normally alerts you through its app and suddenly emails or texts you a link, be wary.

The rule that never fails

If you take only one idea from this guide, make it this: your bank never asks you by email, message or phone for your full password, your PIN, your card code or the one-time codes you receive to approve transactions. Those codes exist precisely so that only you authorise your own movements; when someone asks for them, it's because they're trying to get into your account with them. A widely used scam combines a fake message with a follow-up call: they alarm you by email or text, then phone pretending to be the bank "to help you sort it out", guiding you to hand over your details or read out the code that arrives. Once you internalise that these details are never shared, you become almost immune to these traps.

Check a suspicious email right here

To help you train your eye, here's a tool that inspects an email's headers and flags the typical marks of phishing: whether the authentication checks fail, whether the real sender matches what it claims to be, whether the domain looks like it's imitating a brand, or whether the text uses urgent language or asks for codes. Paste the suspicious email's headers and see what it finds. The whole analysis happens in your browser, so the email's content is never sent anywhere. Treat it as an aid for learning to look, though, not a final verdict: we use it to understand better, not to trust blindly.

You got a suspicious one: what to do and what not to

If you receive an email or message claiming to be from your bank and something feels off, the safest path is also the simplest. Don't click the link, not even "just to see"; don't open attachments; and don't reply, because replying confirms to the scammer that your address is live and makes you a bigger target. Instead of following the message, verify on your own terms: open your bank's official app that you already have installed, or go to its site by typing the address yourself, or call the number on the back of your card. Never use the link or phone number in the suspicious message. From the official channel, check whether there really is any alert or activity. Almost always you'll find the email's "alarm" was pure invention. The official app, by the way, is safer than going through a browser.

If you already gave your details, move fast

If you fell for it and handed over information, don't blame yourself: these tricks are made by professionals, and anyone can slip in a careless moment. What matters now is speed. Open your online banking from the official app and change your password right away; if you gave card details, freeze the card from there. Call your bank on its official number to report what happened so they can watch for or stop suspicious transactions. Review your recent activity and report any charge you don't recognise. Keep the email and all evidence without deleting it, in case you need to file a report. And stay alert over the following days, because scammers often come back pretending to help you recover the money, as a second layer of the same trick. Reacting quickly greatly improves your chances of limiting the damage.

How to protect yourself from now on

Beyond any single email, some habits shield you. Keep your phone and computer up to date, because updates close doors that criminals use. Turn on your bank's notifications so you hear about any movement instantly. Use the official app rather than the browser whenever you can. Enable two-step verification on your email and important accounts. And share these tips with your family, especially older relatives, who are often the preferred target of these scams. If you want to go further — at home or in your business — we can help you check your devices, clear any threats, and make your email and devices safer. Protecting yourself isn't complicated; it's mostly a matter of habits and a little help when you need it.

Frequently asked questions