Unusual activity detected — what it means and what to do next

Q: Does unusual activity detected mean my account is blocked?

Not always. It usually means a security system flagged something for review. Access is often still available unless you receive a separate restriction notice.

Q: If the alert is only in email/SMS, is it more likely a scam?

Risk is higher if the alert is not shown inside your banking app and the message pushes you to click a link or enter credentials. Use your banking app directly (not the message link) to verify.

Q: What usually triggers unusual activity alerts?

Common triggers include a new device, unusual location, sudden spending changes, multiple declined payments, or repeated failed login attempts.

Q: How long does review typically take?

It varies by bank and the trigger. Some checks clear within minutes or hours. If verification is requested or flags repeat, it can take longer.

This is a one-page route for the two real possibilities: a normal security check, or a scam/phishing attempt.

Verification request Account restricted Scam or not Payment failed

What to do now (60 seconds)

Route A: If the alert appears inside your banking app, it’s usually a normal security check.
Route B: If it appears only in email/SMS and asks you to click a link or enter details, treat it as high risk. Even with an in-app alert, never enter credentials via an email link.

Route A — alert is in your banking app

Open the banking app from the app icon (not from the message)
Check recent devices / sessions / login history
Look for related issues like payment failed or card declined
If verification is requested, see bank verification request

Route B — only email/SMS (higher risk)

Step 1: Do not click the link in the message.
Step 2: Open your bank app from the app icon and check if the same alert exists.
Step 3: If it’s not in the app, treat it as suspicious and contact the bank using the number on your card or official website.
Step 4: If anything feels off, freeze/lock the card now, then secure your email and banking password via official channels.

Change passwords only inside the official app or website. Also secure your email account — if email is compromised, bank security may not help.

How to spot a scam message →

What this usually means

“Unusual activity detected” means an automated security system flagged something that doesn’t match your normal pattern (device, location, spending, login attempts). It’s a monitoring flag, not a final conclusion.

Signals → likely meaning

Fast diagnosis without guessing:

Alert is visible in the banking app → usually legitimate (low/medium), but still never enter credentials via message links
Only email/SMS + link asking for login → high suspicion (possible scam)
Login blocked / “too many attempts” → medium/high (security event)
New device / new location notice → medium (normal security trigger)
Multiple declined or failed payments → medium (risk model trigger)
“Verify identity” + deadline → can escalate (see verification request)

Timeline (realistic)

Minutes–hours: automated reviews can clear quickly, especially for known devices
Same day–a few days: sometimes a verification step appears if the trigger is stronger
Escalation depends on triggers: repeated flags or ignored verification can lead to account restricted

If you receive a verification request, the timeline becomes “until verification is completed” — see bank verification request.

Risk level (contextual)

Low

Low if the alert is in-app and there are no restrictions.

No verification requested
No access limits

Medium

Medium if you see repeated flags or failed/declined activity.

Multiple alerts over time
Payments start failing (payment failed)

High

High if the message is only email/SMS with a link, or if restrictions appear.

Link asks for credentials / “verify now”
Even if an in-app alert exists, any link asking for credentials keeps risk high
You receive account restricted or verification request

Common questions

Does unusual activity detected mean my account is blocked?

Not always. It usually means a flag for review. Restrictions are typically communicated separately.

If the alert is only in email/SMS, is it more likely a scam?

Risk is higher if it’s not visible in your banking app and pushes you to click a link or enter credentials. Verify via the app opened from the icon, not via the message link.

What usually triggers unusual activity alerts?

New device/location, unusual spending patterns, repeated declines, or failed login attempts are common triggers.

How long does review typically take?

It varies by bank and trigger. Some checks clear quickly; repeated flags or verification requests can take longer.

Related banking messages

Bank verification request
Account restricted
Bank email: scam or not
Payment failed

Related security concepts

Official guidance:
FTC — Phishing and scam messages
NCSC — Phishing and scams

ClearExplained — simple pages that remove panic and reduce mistakes.