Guatemala Bank Phishing 2026: Is That BI, Banrural or BAC Message Real?

If you have just received a text, a WhatsApp or a call claiming to be Banco Industrial, Banrural, BAC or Bam, this page is built to settle it in about two minutes. Everything below was read from the banks’ own websites on 31 August 2026, and where a bank publishes nothing, this page says not published rather than filling the gap. That matters more than usual here: on a page about spotting fake bank sites, an invented phone number or a wrong domain is not a small error — it is the attack.

Setting up a new account instead? Start with personal account opening by bank or best banks for foreigners in Guatemala.

Is this message real? The three-question check

Run these in order. The first one that fails settles it — you do not need all three.

1. Where does the link actually go? Long-press the link (do not tap it) and read the domain. It must match the bank’s verified domain in the table below, character for character. banrural.com.gt is Banrural. A domain that merely contains the bank’s name — with anything added before the dot, or a different suffix after it — is not, no matter what the display text says. One legitimate exception exists and it looks alarming: Banco Industrial’s bi.com.gt redirects to corporacionbi.com/gt/bancoindustrial/inicio. That is real. It is named here so you do not read a genuine redirect as an attack.

2. What is it asking you to hand over? There is no legitimate scenario in which a bank collects your password, your token code, your SMS validation code, your card PIN, or a full card number through an inbound message or call. That rule is yours to enforce regardless of what your bank does or does not promise — see pledge versus advice below, because only one Guatemalan bank has actually committed to it in writing.

3. Which number are you about to call? Never the one in the message. Attackers supply their own callback number precisely because it feels like you initiated the contact. Use the number in the table below, or the one printed on the back of your card.

Two things that are not by themselves proof of fraud, and are commonly misread as such:

• A WhatsApp from your bank. Several Guatemalan banks run official WhatsApp channels — BAC’s +502 5511 0222 and Promerica’s 4436-1724 both handle fraud reports, and Bam’s official line is +502 2338-6564. The channel is not the signal. What it asks for is.
• A bank that looks different than it used to. Bam changed its visual identity, and its own FAQ carries the question ¿Esto es Phishing o fraude? and answers it with a plain no. That specific case is covered on the Bam bank guide. The general lesson holds either way: a rebrand is exactly the cover a real phisher exploits, so the verification rule never relaxes — open the app or type the address yourself.

Verified official channels, bank by bank

Read from each bank’s own site on 31 August 2026. Eight banks were readable; Banco Industrial blocked automated access entirely, so its row says so rather than carrying stale numbers. Where a cell says Not published, the bank publishes nothing — it is not inferred, estimated or carried over from an older source.

⚠ A trap in G&T’s own page layout. gtc.com.gt does publish hours — Monday to Friday 09:00 to 17:00 and Saturday 09:00 to 13:00 — but that block sits under branch locations, not under the 1718 phone line. Attaching those hours to the phone number would be a fabrication produced purely by reading two adjacent blocks as one. G&T publishes no hours for 1718.

⚠ Bam’s two numbers differ by one digit. The phone line is 2338-6565 and the official WhatsApp is 2338-6564. Both were confirmed against four separate pages on the bank’s own site; the difference is real, not a typo. Transposing them is easy, so save both deliberately.

The two domains that are not banks

This is the single most useful thing on the page, and it is also the correction that prompted the audit. Two domains circulate as official Guatemalan bank sites and belong to no bank:

An unregistered domain published as a bank’s official site is worse than a broken link. Anyone can buy it, point it at a clone of BAC’s login page, and inherit the credibility of every page that vouched for it. Two more non-resolving lookalikes of real banks, in the same hazard class: vivibanco.com does not resolve (the bank is vivibanco.com.gt) and ficohsa.com.gt does not resolve (the bank is ficohsa.gt). And bancogyt.com resolves but is a Squarespace Próximamente placeholder, not the bank.

Why assuming a 24-hour fraud line exists is bad advice here

Anglophone habit assumes a bank has a dedicated, always-open fraud number. In Guatemala, across the eight banks readable on 31 August 2026, not one publishes a separate anti-fraud line — where a fraud channel is published at all it is the general call centre, and G&T and Vivibanco publish none — and coverage is patchy. Banrural is the proof, because it is the only bank that publishes hours per channel, and they contradict each other:

At Banrural, blocking a debit card is not a 24-hour service while blocking a credit card is. If you are defrauded at 2 a.m. believing there is always someone there, you will press the wrong option at the exact moment minutes count. Save your bank’s number with its published hours next to it.

A bank promise and a bank tip are not the same thing

This distinction decides whether an incoming message is proven fraud or merely suspicious, and it is the easiest place for a security page to overclaim.

• A pledge — we will never ask you for X — binds the bank. It lets you treat any such request as fraud, full stop.
• Advice — do not share your credentials — binds only you. It tells you nothing about who just messaged you.

What each bank actually publishes:

So there is no blanket promise on this page, because seven of nine banks never made one. Treat any request for credentials as fraud by your own rule, not on the strength of a guarantee your bank never gave.

The first ten minutes after a compromise

Order matters more than completeness. Bam publishes its own victim sequence — change your passwords immediately, notify the bank at its suspicious-mail address, contact the authorities and detail what happened — and the one step it does not number is the one that should come first.

1. Block, before anything else. Use the fastest channel your bank publishes in the table above. Money moves while you decide what happened. If you are outside Guatemala, dial the country code — Bam’s line as an international number is +502 2338 6565.
2. Change your passwords from a device you trust. If the phone may be compromised, use a computer, not the phone.
3. If your phone lost signal for no reason, call your mobile carrier from another phone. A SIM taken over by someone else routes every SMS code to them. Your carrier’s number is on your bill or on its official site — do not use a number from a message.
4. Report the message itself to the bank. Bam and Banrural have dedicated mailboxes; BAC names info@baccredomatic.com. See the reporting routes below.
5. File the criminal complaint. It is a crime, and the complaint is the document every later claim rests on.
6. Document everything as you go: screenshots of the messages, the numbers that called, and the time and amount of each unauthorised transaction.

Anything about refunds, reversal windows or bank liability that you may read elsewhere is not stated here, because no such terms were captured in the 31 August 2026 read of these banks’ sites — which is not the same as proving no bank publishes them anywhere. Ask your bank directly, with your complaint number in hand.

How to report, and in what order

1 — Your bank. Block through the channel in the table, then report the message. Only three institutions publish a reporting address: correo.sospechoso@bam.com.gt, correo.sospechoso@banrural.com.gt, and BAC’s info@baccredomatic.com with WhatsApp +502 5511 0222.

⚠ A useful pattern with a hard limit. Two of the eight banks use the identical mailbox convention — correo.sospechoso@ at their own domain. That is verified and handy. It is not a rule: do not guess correo.sospechoso@ at any other bank. At the real domain a nonexistent mailbox simply bounces, but mistype the domain — or land on one of the lookalikes above — and your fraud report, with your account details in it, goes to a stranger. For every other bank, use that bank’s own contact page.

2 — Ministerio Público (the crime). The MP takes complaints online through Yo Denuncio. Its switchboard is 2411-9191 and the central building is at 15 avenida 15-16, zona 1, Barrio Gerona. Police emergency lines are 110 and 120.

3 — Superintendencia de Bancos, only if the bank itself fails you. The SIB handles complaints against supervised entities — my bank mishandled this — and is not a crime line and not an emergency hotline. Its consumer channel is published as guidance for filing a request or complaint, including one specifically for credit-card disputes. Note that the SIB’s own contact details could not be read live on 31 August 2026 because the site blocks automated access; an archived snapshot dated 9 November 2024 lists PBX (502) 2429-5000 / (502) 2204-5300 and hours of Mon–Fri 8:00–16:00. Confirm those before relying on them — but the shape of the point holds either way: the regulator is not open at 2 a.m. either.

One thing this page deliberately does not say: that a Guatemalan government agency has issued a warning about bank text-message phishing. The MP’s own site search was queried on 31 August 2026 for phishing, estafa bancaria, fraude electrónico and smishing and returned zero results for all four — a real absence from a working search endpoint. Anyone citing an official Guatemalan advisory on this should be asked for the link.

Verify the app before you install it

The publisher string in the store listing is the check that actually works, because a fake app can copy the logo and the name but not the developer of record. The worked example, verified on 31 August 2026:

Do the same for your own bank: open its official site (from the verified domain column above), find the exact app name and online-banking name it uses, and confirm both against the store listing before installing. This page does not publish app names for the other eight institutions — they were not verified in this audit, and an unverified app name on an anti-phishing page is the same defect class as an unverified domain. For app quality and ratings rather than authenticity, see the mobile banking app comparison.

What could not be verified, and why that is stated

Two gaps, named rather than papered over:

• Banco Industrial blocked every automated request on 31 August 2026 behind a bot challenge. Its call-centre numbers, hours, phishing mailbox and any security guidance it may publish are therefore absent from this page rather than guessed. Get them from corporacionbi.com/gt/bancoindustrial/inicio in a normal browser, or from the back of your card. For its two banking platforms see BI en Línea vs BI Móvil.
• Superintendencia de Bancos — also bot-blocked, so nothing is quoted from it as current; the archived figures above carry their snapshot date.

Both sites are fine in a real browser. Blocked to a script is not the same as dead, and neither is a reason to publish a number nobody checked.

Keep reading

• Banco Agromercantil (Bam) guide — the one bank whose channels, app publisher and account rules are fully verified here.
• Mobile banking apps compared — ratings and features, once you know the app is genuine.
• Personal account opening by bank — set the security options up on day one.
• Best banks for foreigners in Guatemala — which banks accept which immigration status.
• How to open a Banrural account — the bank with the per-channel blocking hours above.
• USD accounts in Guatemala compared — splitting balances across institutions.
• International wire transfers — sending larger amounts without exposing your main account.
• Banks in Guatemala City — branches to walk into when a phone line is closed.
• All Guatemala banking guides — the full section index.

Primary sources, read 31 August 2026: bam.com.gt cyberfraud page · Bam contact · Banrural consultas · Banrural: how to detect phishing · BAC security advice · gtc.com.gt · Banco Promerica security advice · Bantrab security recommendations · Ficohsa: Todos Contra el Fraude · vivibanco.com.gt · corporacionbi.com · app publisher check via Google Play and the App Store. Reporting: Ministerio Público · Yo Denuncio · Superintendencia de Bancos. The Banco Industrial and SIB sites blocked automated access that day, so no current figure is quoted from either.

Last verified: 31 August 2026. Phone numbers, published hours and security pages change without notice — re-check your own bank’s contact page before you need it, and save the number with its hours.