RBC Phishing Scam: How to Spot Fake Royal Bank of Canada Alerts
Royal Bank of Canada (RBC) is Canada's largest bank by assets and customer base, with over 17 million customers across Canada, the United States, and internationally. This massive scale makes RBC the top impersonation target for phishing scammers. Every day, thousands of fake RBC emails and text messages are sent to Canadian consumers, attempting to harvest online banking credentials and enable account takeover attacks. The sophistication of modern RBC phishing attacks has increased dramatically, with scammers using cloned banking interfaces, spoofed sender addresses, and AI-generated content to create convincing replicas of legitimate RBC communications. Understanding the hallmarks of RBC phishing is essential for protecting your accounts and finances.
RBC as Canada's Largest Bank and Top Impersonation Target
RBC's prominence in Canadian banking makes it an exceptionally valuable target for cybercriminals. A phishing email impersonating RBC has a higher success rate than emails impersonating smaller banks or less well-known services because RBC's brand recognition and ubiquity mean most recipients are already RBC customers or recognize RBC as a legitimate institution. Additionally, RBC's size means that a phishing campaign targeting RBC customers reaches an enormous audience, increasing the likelihood that some fraction of recipients will fall victim to the scam. Scammers have invested considerable resources in creating increasingly sophisticated RBC phishing attacks, including registering lookalike domains, creating pixel-perfect replicas of RBC's website and mobile app interface, and using social engineering tactics to increase urgency and compliance.
Types of RBC Phishing Attacks
RBC phishing campaigns use multiple attack vectors, each tailored to exploit different vulnerabilities in how customers interact with their bank. The most common type is the account lockout scam, where you receive an email claiming that your RBC account has been locked due to suspicious activity or failed login attempts. The email directs you to click a link to unlock your account, which takes you to a fake RBC portal where you enter your credentials. In reality, your account was never locked; the scammers are harvesting your login information.
Another prevalent attack is the suspicious transaction alert. You receive an email or text claiming that an unusual transaction has been detected on your account and asking you to click a link to review or confirm the transaction. Legitimate RBC alerts do include transaction details and can include a link to the official RBC website, but scammers exploit this format by creating fake alerts with links to phishing pages. The alert creates a sense of urgency and concern that primes you to act quickly without fully verifying the message's authenticity.
RBC Mobile app update phishing is another common attack. Scammers send emails or texts claiming that the RBC Mobile app requires an update for security purposes and directing you to click a link. However, the link either takes you to a fake app store page or a phishing portal where you're asked to enter your credentials under the guise of verifying your identity for the update. In some cases, scammers embed malicious code in a fake RBC app that you're tricked into installing, which can capture your login credentials and monitor your banking activity.
E-Transfer notification spoofing is another RBC-specific phishing variant. Scammers send you a fake email appearing to come from RBC or Interac claiming that an e-Transfer has been sent to you but requires action to complete. The email contains a link that takes you to a phishing page where you're prompted to enter your banking credentials or e-Transfer PIN. Once the scammers have this information, they can access your account and perform unauthorized transfers.
The OTP Relay Scam Targeting RBC Customers
A particularly insidious RBC phishing variant is the OTP relay scam, also known as a SIM swap or account takeover attack. In this attack, you receive a phone call claiming to be from RBC's fraud department. The caller states that unusual activity has been detected on your account and that they need to verify your identity. They walk you through logging into your RBC online banking or mobile app while on the call. As you log in, the system generates a one-time password (OTP) that's sent to your phone. The scammer then asks you to provide this OTP "for verification purposes," claiming they need it to complete their investigation. Once you provide the OTP, the scammer logs into your account and performs unauthorized transfers, often disguised as legitimate-looking transactions to you and your bank's fraud detection systems.
The OTP relay attack is effective because it exploits the trust people place in perceived authority (a bank calling you) and the confusion around what the OTP is actually being used for. Most people are aware that banking security requires OTPs and don't realize that by providing an OTP to someone on the phone, they're essentially providing root access to their account. The key defense is understanding that RBC will never call you and ask for your OTP. If you receive a call from someone claiming to be RBC and asking for an OTP or password, hang up immediately and call RBC directly using the number on your bank statement or card.
Fake RBC Client Card Renewal Text Messages
Scammers frequently send SMS text messages claiming that your RBC client card (debit card) requires renewal and asking you to click a link to renew it. These messages appear to come from RBC and use official-looking formatting and language. When you click the link, you're taken to a fake RBC portal where you're prompted to enter your card details, PIN, or online banking credentials. These SMS phishing attacks, known as smishing, are particularly effective because text messages feel more direct and personal than emails and are less likely to be scrutinized for suspicious links.
How Real RBC Communicates With Customers
Understanding how legitimate RBC communications function is essential for identifying fakes. Real RBC only communicates through official channels: the RBC website at rbc.com, the official RBC Mobile app, and direct mail or phone calls using official RBC phone numbers found on your bank statement or card. RBC will never send unsolicited emails asking you to verify credentials, provide your PIN, or confirm personal information via a link. RBC's official website uses the rbc.com domain; any variation such as rbc-canada.com, rbc-login.com, or rbc-secure.com is fraudulent.
When RBC does contact you via email, the email will never ask you to click a link to log in to your account. Instead, legitimate RBC emails may alert you to important information but will always instruct you to log in by going directly to rbc.com or using the RBC Mobile app. Additionally, legitimate RBC communications will not request your PIN, full card number, or password. RBC staff already have access to your account information and will never need you to provide these details for verification purposes.
How to Verify Your RBC Account Status
If you receive a suspicious RBC email or text claiming that your account has been locked, compromised, or requires action, the safest way to verify the legitimacy of the claim is to log in to your account directly through official channels. Do not click any links in the suspicious message. Instead, open a fresh browser window and navigate to rbc.com by typing the address directly into the address bar, or open the official RBC Mobile app. Log in with your credentials and check your account status. If there are any legitimate alerts or messages from RBC, they will appear in your account dashboard. If you don't see any alerts in your account, the email or text was fraudulent.
Alternatively, you can call RBC's customer service directly using the phone number on your RBC card or bank statement. Customer service representatives can verify whether any claims in the suspicious message are legitimate. This direct verification approach completely bypasses phishing links and ensures you're communicating with RBC directly.
RBC's Official Fraud Contact Number vs. Spoofed Numbers
RBC's official fraud contact number is 1-800-769-2511 (in Canada). This number is clearly displayed on RBC statements, cards, and the official website. However, scammers often include fake phone numbers in phishing emails that closely resemble the official number, such as 1-800-769-2513 or 1-800-769-2511 with a different area code prefix. If you're unsure about the legitimacy of a phone number in an email or text, never dial it directly. Instead, look up the official RBC contact number from your bank statement or the official website and call that number to inquire about the suspicious message.
Steps to Take If Your Credentials Were Compromised
If you've entered your RBC online banking credentials on a phishing page or provided credentials to a scammer in a phone call, take immediate action. First, change your RBC online banking password immediately by logging in through the official RBC Mobile app or website. Use a strong, unique password that you haven't used on any other accounts. Second, enable multi-factor authentication (MFA) on your RBC account if you haven't already. MFA adds an additional security layer requiring a second form of verification to access your account. Third, contact RBC's fraud department immediately at 1-800-769-2511 to report the compromise and request that they place a fraud alert on your account. RBC can monitor your account for suspicious activity and may be able to prevent fraudulent transfers if notified quickly. Fourth, review your recent account statements and transactions carefully for any unauthorized activity. If you notice unauthorized transfers, report them to RBC immediately.
Additionally, consider placing a fraud alert or credit freeze with Canadian credit reporting agencies Equifax Canada and TransUnion Canada. This makes it harder for someone with your personal information to open new accounts in your name. Finally, monitor your credit report regularly for signs of identity theft, such as new accounts you didn't open or inquiries you didn't authorize.
Reporting RBC Phishing to the Bank and Authorities
Report phishing emails to RBC's fraud team by forwarding them to phishing@rbc.com or through your RBC online banking interface if there's a report phishing option. You can also report phishing SMS text messages by forwarding them to 99999 (standard Canadian SMS reporting code) and then notifying RBC directly. Additionally, report the phishing attempt to the Canadian Anti-Fraud Centre (CAFC) at cafc.ca. The CAFC collects fraud reports and shares data with law enforcement, helping to identify and shut down phishing infrastructure. If you've lost money to fraud, report it to your local law enforcement agency as well; this creates an official record that can be useful for fraud recovery or credit repair later.
Other Scams to Watch For
People researching this scam also check these related pages.
TD Bank Scam
Identify TD Bank impersonation scams and phishing attempts.
Check NowCIBC Scam
Recognize fake CIBC messages and account phishing attacks.
Check NowBMO Phishing
Spot fraudulent BMO Bank of Montreal phishing emails.
Check NowScotiabank Phishing
Identify Scotiabank phishing messages and spoofed emails.
Check NowEQ Bank Scam Checker
Verify EQ Bank messages and spot digital banking scams.
Check NowSimplii Financial Scam Checker
Check suspicious Simplii Financial messages for fraud.
Check NowTangerine Scam Checker
Detect fake Tangerine bank messages and phishing scams.
Check NowPC Financial Scam Checker
Identify PC Financial fraud attempts and spoofed messages.
Check NowWill RBC ever ask me to verify my PIN or password via email?
No. RBC will never ask you to provide your PIN, password, or full card number via email, text, or phone call. RBC staff already have access to your account information and will never need you to provide these sensitive details for any reason. If you receive a message claiming to be from RBC asking for these details, it is a phishing attempt.
What should I do if I receive an RBC alert about suspicious activity?
Do not click any links in the email or text. Instead, log into your RBC account directly through the official RBC Mobile app or rbc.com to check if there are legitimate alerts. You can also call RBC's customer service using the number on your bank statement. Legitimate RBC alerts will be visible in your official account dashboard, not just in an email.
Is it safe to click links in RBC emails?
The safest approach is to never click links in unsolicited RBC emails. Even if a link appears to go to rbc.com, it could be a phishing link that takes you to a fake page. Instead, open a fresh browser window and navigate to rbc.com directly, or use the official RBC Mobile app, to verify any alerts or messages.
What is an OTP relay scam and how do I protect myself?
An OTP relay scam occurs when someone calls claiming to be from RBC's fraud department and asks you to provide your one-time password. By providing your OTP, you're essentially giving them access to your account. RBC will never call you and ask for your OTP or password. If you receive such a call, hang up immediately and call RBC back using the number on your statement.
How can I enable multi-factor authentication on my RBC account?
You can enable MFA in your RBC online banking settings. Log into your account through the official RBC Mobile app or rbc.com, navigate to security settings, and enable multi-factor authentication. This typically involves receiving a code via text or authenticator app that you must provide in addition to your password when logging in, adding a significant security layer against account compromise.