Recovery checklist after opening a fake bank link
← Puerto Rico
Puerto Rico

Clicked a link in a fake bank text? What to do now in Puerto Rico

If you opened a link in a text that claimed to be your bank, or typed your password, call the bank, report to the FTC and the FBI, and file a complaint with OCIF if the bank doesn't resolve it. Step by step for Puerto Rico.

Rampart Puerto Rico Editorial Team · October 20, 2026

  • If you only opened the link and typed nothing, close the page and check your accounts in your bank's official app.
  • If you typed your password, card details or a code, call the bank right now. Federal protections apply in Puerto Rico, and telling the bank within two business days limits what you could lose on a debit card.
  • Report it to the FTC and the FBI (IC3). If the bank doesn't resolve it, file a complaint with OCIF.
  • Rampart, an iPhone app, checks your texts on the device and warns you when one looks risky, before you tap it.

The text usually looks real: "(BLOCKED) Your card has been blocked due to suspicious activity," with a link or a number to "unblock" it. If you already opened it, this isn't the moment to blame yourself. What helps now is moving fast.

In this guide

What to do based on what happened

What happenedWhat to do now
You only opened the linkClose the page without typing anything. Check your accounts in the official app.
You typed your username and passwordChange the password in the official app or site and call the bank.
You typed your card detailsCall the bank and ask them to block the card. Check your transactions.
You gave a verification codeCall the bank immediately. Treat the account as compromised.
You called the number in the textHang up if you're still on the call, then call the bank's official number.
You use that same password elsewhereChange it there too.

Do this in order

  1. Call the bank on its official number: the one on the back of your card, in the app, or on the site you type in yourself. Never use the number or link in the text.
  2. Ask them to block the card or account. For a debit card, reporting within two business days matters.
  3. Change your password in the real app or site.
  4. Screenshot the text, the link, the page and any conversation.
  5. Forward the text to 7726 and report it to the FTC at ReportFraud.ftc.gov. If you gave out personal details, also go to IdentityTheft.gov for a recovery plan.
  6. File a report with IC3, the FBI's complaint center.
  7. Next time, have Rampart installed. When a suspicious text arrives, it warns you before you tap it.

If you gave a verification code

Treat it as urgent. With a code, someone can sign in to your account, add a new phone or approve a transfer.

Stop replying. Often a call follows the text, from someone who says they're "from the bank's fraud department" and asks for another code. OCIF is clear that it will never contact you to say your bank account has been compromised. Hang up and call the bank yourself. You only need to say:

"I gave a code after getting a suspicious text that claimed to be from the bank."

How much you could lose under federal rules

ProductWhat the rule says
Debit card or accountIf you report within two business days, the most you owe is $50. After that, up to $500. Charges on your statement must be reported within 60 days.
Credit cardThe most you owe for unauthorized charges is $50. To dispute a charge, send written notice within 60 days after it appears on your statement.

These rules come from the Consumer Financial Protection Bureau (CFPB). According to the CFPB, if a scammer tricked you into giving your password or code and then moved the money, that transfer counts as unauthorized, and your carelessness can't increase what you owe. It's different if you sent the money yourself: that transfer counts as authorized. The bank also can't require a police report before it investigates. Once you report, it has 10 business days to investigate, or up to 45 days if it provisionally credits your account.

Where to report and complain

WhereWhat for
Your bankBlock the card or account and dispute the charges.
FTC, ReportFraud.ftc.gov and 7726Report the fraud and the text message.
FBI, IC3Report the fraud. In some cases it can help freeze stolen funds.
OCIFComplain about the bank if it doesn't resolve it: online, at [email protected], or at (787) 723-8445 / (800) 981-7711.
CFPBFile a federal complaint against the bank.
Puerto Rico PoliceFile a report (querella) at the nearest precinct. Confidential line: 787-343-2020.
DACO Anti-Fraud UnitReport the scam text. DACO publishes weekly alerts on these schemes.

Whichever you use, have your details, a clear description of what happened and your screenshots ready.

If it happened to someone in your family

Don't start with "how could you?" Start with:

"You did the right thing telling me. Let's call the bank together."

Shame makes people hide the next text, and that helps the scammer.

Frequently asked questions

If you typed nothing, probably not, but check your accounts in the official app. If you typed anything, change it.

Should I delete the text?

Not yet. Screenshot it and forward it to 7726 first.

Will I get my money back?

If the scammer moved the money using your details, federal law protects you: on a credit card the most you owe is $50, and on a debit card it depends on how fast you report. If you sent the transfer yourself, it's harder. Call today and keep the evidence.

Does Rampart block calls?

No. Rampart checks texts and, if you connect Gmail or Outlook, emails too. It doesn't replace your bank or a report. Its job is to give you a pause before you tap a suspicious message.

In short

If you opened a fake bank link and typed nothing, close the page and check your accounts in the app. If you typed your password, card or a code, call the bank today, block your products, report to the FTC and IC3, and if the bank doesn't resolve it, file a complaint with OCIF.

Sources