Unexpected Bank Card in the Mail? Don’t Activate It – It Might Be a Scam

Finding a new bank card in your mailbox may look like a routine replacement. But if you didn't request it, don't assume it’s really from your bank.

Portugal’s National Republican Guard (GNR) recently warned about a new scam that begins with an unsolicited bank card delivered to someone’s home. The card can be followed by a phone call, text message or email from a person claiming to represent a bank or financial institution.

They may say the card needs to be activated, cancelled or verified. Their real goal is to obtain personal and banking information, including passwords, PINs or one-time security codes that could give them access to your account.

Key takeaways

• A bank card you did not request could be the start of a scam
• Do not activate, use or share information connected to an unexpected card
• A phone call, email or text that follows may be part of the same scheme
• Never give anyone your PIN, online-banking password or verification code
• Contact your bank independently using its official app, website or the number on your existing card
• If you have shared information, contact your bank immediately and tell people in your household what happened

How the unexpected bank card scam works

The scam starts when a card arrives at your home, even though you never asked for a new one or replacement.

That unexpected delivery can create confusion. Is it an administrative error? Has someone opened an account in your name? Is your current card compromised?

Scammers rely on those questions and may message or call you, claiming there is a problem with the card or saying it needs to be activated before it can be canceled.

They may ask you to confirm personal details, provide card information, enter credentials through a link, or read out a code sent to your phone.

Don't trust any of these requests just because a card arrived at your address. The delivery of the card can be the first step in making the follow-up contact feel legitimate.

What to do if an unsolicited bank card arrives

Do not use the card, try to activate it or follow any instructions included with it until you have verified it directly with your bank.

Here’s what to do instead:

• Open your banking app and check for new accounts, cards or unfamiliar activity
• Call your bank using the number printed on the original card or listed on its official website or in the app
• Do not use a phone number, QR code, link or email address included in an unexpected message or package
• Ask the bank whether the card is genuine and whether anyone has tried to open an account or make changes in your name
• Keep the card and any related messages in case your bank or police asks for them

If you receive a call, text or email about the card, do not share your PIN, passwords, account details or verification codes. A real bank will not need you to reveal these details to an unexpected caller.

Remember, a card delivery can be followed by more pressure. Fraudsters may initially send you a text and follow up with a phone call. The caller may know your name, address or bank, then use that information to establish trust and make the situation feel urgent and real.

But knowing your personal details doesn't prove the caller is a legitimate representative from your bank. Information can be gathered from data breaches, public records, social media or previous scams.

That is also why you should independently verify anything connected to your bank account. End the unexpected conversation and contact your bank through a verified channel.

Never move money to a so-called safe account, withdraw cash, hand over your existing card or give a stranger access to your online banking because they claim there is an investigation or security issue.

Similar scams can move from your phone to your front door

This alert shares an important theme with a recent doorstep bank-card scam, where criminals used texts and spoofed calls before sending someone to collect a victim’s supposedly compromised card.

The exact tactics may differ, but the rule remains the same: your bank will not send an unexpected visitor to collect your card, PIN, cash or account information.

If someone arrives at your home claiming to be from your bank, do not hand over anything and do not let them inside. Close the door and contact your bank independently. If the person refuses to leave or makes you feel unsafe, contact local law enforcement.

If you have already shared information

Act quickly if you used the card, entered information on a linked website, or gave someone your banking credentials, PIN or verification code.

Contact your bank immediately and ask it to block any affected cards and review your account for unauthorized activity. Change compromised online-banking credentials from a trusted device, especially if you reuse that password elsewhere. Check for unfamiliar transfers, beneficiaries, contact details or changes to your account.

Save screenshots, messages, phone numbers and emails connected to the scam. Report the incident to your bank and local police. It is also worth telling family members, particularly older relatives, so they know to be cautious about unexpected cards, follow-up calls and visitors.

You can use Bitdefender Scamio to check suspicious messages, emails and screenshots, while Bitdefender Link Checker can help you inspect a questionable URL before opening it.

An unexpected card is not something to panic about. But it is a reason to slow down, avoid engaging with anyone who contacts you about it, and verify the situation directly with your bank.