Guatemala Bank Phishing 2026: Is That BI, Banrural or BAC Message Real?

If you have just received a text, a WhatsApp or a call claiming to be Banco Industrial, Banrural, BAC or Bam, this page is built to settle it in about two minutes. Everything below was read from the banks’ own websites on 31 August 2026, and where a bank publishes nothing, this page says not published rather than filling the gap. That matters more than usual here: on a page about spotting fake bank sites, an invented phone number or a wrong domain is not a small error — it is the attack.

Setting up a new account instead? Start with personal account opening by bank or best banks for foreigners in Guatemala.

Is this message real? The three-question check

Run these in order. The first one that fails settles it — you do not need all three.

1. Where does the link actually go? Long-press the link (do not tap it) and read the domain. It must match the bank’s verified domain in the table below, character for character. banrural.com.gt is Banrural. A domain that merely contains the bank’s name — with anything added before the dot, or a different suffix after it — is not, no matter what the display text says. One legitimate exception exists and it looks alarming: Banco Industrial’s bi.com.gt redirects to corporacionbi.com/gt/bancoindustrial/inicio. That is real. It is named here so you do not read a genuine redirect as an attack.

2. What is it asking you to hand over? There is no legitimate scenario in which a bank collects your password, your token code, your SMS validation code, your card PIN, or a full card number through an inbound message or call. That rule is yours to enforce regardless of what your bank does or does not promise — see pledge versus advice below, because only one Guatemalan bank has actually committed to it in writing.

3. Which number are you about to call? Never the one in the message. Attackers supply their own callback number precisely because it feels like you initiated the contact. Use the number in the table below, or the one printed on the back of your card.

Two things that are not by themselves proof of fraud, and are commonly misread as such:

• A WhatsApp from your bank. Several Guatemalan banks run official WhatsApp channels — BAC’s +502 5511 0222 and Promerica’s 4436-1724 both handle fraud reports, and Bam’s official line is +502 2338-6564. The channel is not the signal. What it asks for is.
• A bank that looks different than it used to. Bam changed its visual identity, and its own FAQ carries the question ¿Esto es Phishing o fraude? and answers it with a plain no. That specific case is covered on the Bam bank guide. The general lesson holds either way: a rebrand is exactly the cover a real phisher exploits, so the verification rule never relaxes — open the app or type the address yourself.

Verified official channels, bank by bank

Read from each bank’s own site on 31 August 2026. Eight banks were readable; Banco Industrial blocked automated access entirely, so its row says so rather than carrying stale numbers. Where a cell says Not published, the bank publishes nothing — it is not inferred, estimated or carried over from an older source.

⚠ A trap in G&T’s own page layout. gtc.com.gt does publish hours — Monday to Friday 09:00 to 17:00 and Saturday 09:00 to 13:00 — but that block sits under branch locations, not under the 1718 phone line. Attaching those hours to the phone number would be a fabrication produced purely by reading two adjacent blocks as one. G&T publishes no hours for 1718.

⚠ Bam’s two numbers differ by one digit. The phone line is 2338-6565 and the official WhatsApp is 2338-6564. Both were confirmed against four separate pages on the bank’s own site; the difference is real, not a typo. Transposing them is easy, so save both deliberately.

The two domains that are not banks

This is the single most useful thing on the page, and it is also the correction that prompted the audit. Two domains circulate as official Guatemalan bank sites and belong to no bank:

An unregistered domain published as a bank’s official site is worse than a broken link. Anyone can buy it, point it at a clone of BAC’s login page, and inherit the credibility of every page that vouched for it. Two more non-resolving lookalikes of real banks, in the same hazard class: vivibanco.com does not resolve (the bank is vivibanco.com.gt) and ficohsa.com.gt does not resolve (the bank is ficohsa.gt). And bancogyt.com resolves but is a Squarespace Próximamente placeholder, not the bank.

Why assuming a 24-hour fraud line exists is bad advice here

Anglophone habit assumes a bank has a dedicated, always-open fraud number. In Guatemala, across the eight banks readable on 31 August 2026, not one publishes a separate anti-fraud line — where a fraud channel is published at all it is the general call centre, and G&T and Vivibanco publish none — and coverage is patchy. Banrural is the proof, because it is the only bank that publishes hours per channel, and they contradict each other:

At Banrural, blocking a debit card is not a 24-hour service while blocking a credit card is. If you are defrauded at 2 a.m. believing there is always someone there, you will press the wrong option at the exact moment minutes count. Save your bank’s number with its published hours next to it.

A bank promise and a bank tip are not the same thing

This distinction decides whether an incoming message is proven fraud or merely suspicious, and it is the easiest place for a security page to overclaim.

• A pledge — we will never ask you for X — binds the bank. It lets you treat any such request as fraud, full stop.
• Advice — do not share your credentials — binds only you. It tells you nothing about who just messaged you.

What each bank actually publishes:

So there is no blanket promise on this page, because seven of nine banks never made one. Treat any request for credentials as fraud by your own rule, not on the strength of a guarantee your bank never gave.

The first ten minutes after a compromise

Order matters more than completeness. Bam publishes its own victim sequence — change your passwords immediately, notify the bank at its suspicious-mail address, contact the authorities and detail what happened — and the one step it does not number is the one that should come first.

1. Block, before anything else. Use the fastest channel your bank publishes in the table above. Money moves while you decide what happened. If you are outside Guatemala, dial the country code — Bam’s line as an international number is +502 2338 6565.
2. Change your passwords from a device you trust. If the phone may be compromised, use a computer, not the phone.
3. If your phone lost signal for no reason, call your mobile carrier from another phone. A SIM taken over by someone else routes every SMS code to them. Your carrier’s number is on your bill or on its official site — do not use a number from a message.
4. Report the message itself to the bank. Bam and Banrural have dedicated mailboxes; BAC names info@baccredomatic.com. See the reporting routes below.
5. File the criminal complaint. It is a crime, and the complaint is the document every later claim rests on.
6. Document everything as you go: screenshots of the messages, the numbers that called, and the time and amount of each unauthorised transaction.

Anything about refunds, reversal windows or bank liability that you may read elsewhere is not stated here, because no such terms were captured in the 31 August 2026 read of these banks’ sites — which is not the same as proving no bank publishes them anywhere. Ask your bank directly, with your complaint number in hand.

How to report, and in what order

1 — Your bank. Block through the channel in the table, then report the message. Only three institutions publish a reporting address: correo.sospechoso@bam.com.gt, correo.sospechoso@banrural.com.gt, and BAC’s info@baccredomatic.com with WhatsApp +502 5511 0222.

⚠ A useful pattern with a hard limit. Two of the eight banks use the identical mailbox convention — correo.sospechoso@ at their own domain. That is verified and handy. It is not a rule: do not guess correo.sospechoso@ at any other bank. At the real domain a nonexistent mailbox simply bounces, but mistype the domain — or land on one of the lookalikes above — and your fraud report, with your account details in it, goes to a stranger. For every other bank, use that bank’s own contact page.

2 — Ministerio Público (the crime). The MP takes complaints online through Yo Denuncio. Its switchboard is 2411-9191 and the central building is at 15 avenida 15-16, zona 1, Barrio Gerona. Police emergency lines are 110 and 120.

3 — Superintendencia de Bancos, only if the bank itself fails you. The SIB handles complaints against supervised entities — my bank mishandled this — and is not a crime line and not an emergency hotline. Its consumer channel is published as guidance for filing a request or complaint, including one specifically for credit-card disputes. Note that the SIB’s own contact details could not be read live on 31 August 2026 because the site blocks automated access; an archived snapshot dated 9 November 2024 lists PBX (502) 2429-5000 / (502) 2204-5300 and hours of Mon–Fri 8:00–16:00. Confirm those before relying on them — but the shape of the point holds either way: the regulator is not open at 2 a.m. either.

One thing this page deliberately does not say: that a Guatemalan government agency has issued a warning about bank text-message phishing. The MP’s own site search was queried on 31 August 2026 for phishing, estafa bancaria, fraude electrónico and smishing and returned zero results for all four — a real absence from a working search endpoint. Anyone citing an official Guatemalan advisory on this should be asked for the link.

Verify the app before you install it

The publisher string in the store listing is the check that actually works, because a fake app can copy the logo and the name but not the developer of record. The worked example, verified on 31 August 2026:

Do the same for your own bank: open its official site (from the verified domain column above), find the exact app name and online-banking name it uses, and confirm both against the store listing before installing. This page does not publish app names for the other eight institutions — they were not verified in this audit, and an unverified app name on an anti-phishing page is the same defect class as an unverified domain. For app quality and ratings rather than authenticity, see the mobile banking app comparison.

Set the app up so one mistake is not enough

Everything above deals with a message that has already arrived. This section is what you do beforehand, and it is the part most people skip. It takes about ten minutes, once, the next time you open your bank’s app.

The four layers

A properly protected mobile banking setup has four layers an attacker has to break in sequence:

1. Physical access to the phone — defence: screen PIN + the OS biometrics (iOS Face ID, Android fingerprint).
2. Access to the bank app — defence: the bank’s own biometrics + a strong password.
3. Transaction validation — defence: 2FA (virtual token / push / SMS) + a push notification on every movement.
4. Amount and recipient validation — defence: low daily limits + pre-registered beneficiaries + SMS alerts.

Breaking one or two layers should not be enough to empty the account. Successful frauds usually happen when the victim hands over several layers at once — typically to a phishing page that asks for the password and the SMS code.

Which second factor to choose, without an invented comparison

The mechanisms seen in Guatemalan banking are: a physical token (a hardware keyfob, typically in corporate banking), a virtual token inside the bank’s app, an SMS code to the registered mobile, a push notification to approve transactions, and biometrics for app login. Which combination each bank offers varies by app and by customer type, and no Guatemalan bank publishes a comparable sheet of what its app supports — so this page carries no bank-by-bank 2FA matrix, because such a table would be invented. What you can check inside your own app in two minutes:

1. Security settings → biometrics: enable it for login.
2. Transaction validation method: if a virtual token or push is offered, choose it over SMS.
3. Push notifications per transaction: turn them all on — that is your real-time alarm.
4. If your app validates only by SMS, ask your carrier for an account PIN (the anti-SIM-swap defence below) and consider asking the bank whether a virtual token exists for your account type.

Safest: biometrics + in-app virtual token + transaction push. Less safe but still acceptable: biometrics + SMS, carrying SIM-swap risk. Not acceptable: password only, with no biometrics and no 2FA.

SIM swap: why an SMS code is the weakest factor here

How it works. A criminal obtains a replica of your SIM card by impersonating you at Tigo or Claro — sometimes with a complicit employee, sometimes using personal data from a leak. When the new SIM activates, your phone loses signal and every SMS goes to the thief. With your intercepted SMS codes plus account details obtained by phishing, the account gets drained.

Defences:

• Ask your carrier for an account security PIN (Tigo or Claro). The idea: without that PIN, a third party should not be able to request a replacement SIM. Ask your carrier how to enable it and whether it costs anything — those conditions are set by the carrier, not by this page.
• Use the app’s virtual token instead of SMS for transaction validation.
• If your phone loses signal for no apparent reason — not a dead zone, not out of data, not aeroplane mode — assume a SIM swap: call the carrier immediately from another phone, then the bank.
• Turn on the bank’s push notifications as well as SMS. Push travels over the internet rather than the carrier’s mobile network, so it survives a SIM takeover.

Two attacks the message check does not cover

ATM skimming. Criminals fit devices to cash machines that capture the chip or magnetic stripe, plus a hidden camera to record your PIN; the card is then cloned and used at other ATMs. Defences: use ATMs inside bank branches, or in malls with security; cover the keypad with your hand when entering the PIN; inspect the machine before inserting the card — if the reader looks loose or has parts stuck onto it, walk away; turn on push alerts for any card use, if your app offers them; prefer chip and contactless over the magnetic stripe.

The phone call. They call claiming to be the bank, say they have detected suspicious transactions, and need to validate your identity. Piece by piece they extract the account number, the three-digit code on the back of the card and the SMS validation code — and then move your money. Defences: hang up. Give that data to nobody who calls you, whatever they say, and call back yourself on the official number in the table above if you want to confirm it really was the bank. Never share an SMS validation code, your password, the card’s CVV or your PIN.

Two further signals on the written version of the same attack: artificial urgency — invented deadlines of the act within the hour or your account will be closed kind — and bad grammar or spelling.

Using a Guatemalan bank app from the US, Canada or the UK

If you live abroad and keep accounts in Guatemala — common in the diaspora, whether it is a USD account in Guatemala or accounts kept for family — four things change:

• SMS validation sent to a Guatemalan number does not reach you when you are abroad and the SIM is sitting in Guatemala.
• Turn on the app’s virtual token. It works regardless of where you physically are.
• Set your second factor up before you travel. Banks do not publish their additional verification rules for access from abroad, so there is no way to anticipate which one will be applied to you — solve access while you are still in the country.
• Turn on geo-locks (blocking transactions from outside the country) except while travelling — if your app offers them; banks publish no comparable list of which ones do.

If the app starts blocking you rather than a fraudster, check the boring cause first: your tax ID. Use the CUI/NIT lookup to confirm your NIT is active, or how to get a NIT if you do not have one.

Habits that matter after the setup

• Check your statements every 7–10 days in the app — do not wait for the monthly statement.
• Update the bank app as soon as a new version ships; banks patch vulnerabilities in them.
• Update the phone’s operating system (iOS, Android) regularly — outdated versions carry known vulnerabilities.
• Do not bank on public Wi-Fi (cafés, airports). Use mobile data or a private network.
• Do not hand your phone to a stranger with the app open.
• Change the bank password every six months. Not strictly required in Guatemala, but it shortens the exposure window if the password leaks.
• If you hold a large balance (over Q100,000), consider splitting it across two banks — that diversifies the risk if one bank has a security incident.

What could not be verified, and why that is stated

Two gaps, named rather than papered over:

• Banco Industrial blocked every automated request on 31 August 2026 behind a bot challenge. Its call-centre numbers, hours, phishing mailbox and any security guidance it may publish are therefore absent from this page rather than guessed. Get them from corporacionbi.com/gt/bancoindustrial/inicio in a normal browser, or from the back of your card. For its two banking platforms see BI en Línea vs BI Móvil.
• Superintendencia de Bancos — also bot-blocked, so nothing is quoted from it as current; the archived figures above carry their snapshot date.

Both sites are fine in a real browser. Blocked to a script is not the same as dead, and neither is a reason to publish a number nobody checked.

Keep reading

• Banco Agromercantil (Bam) guide — the one bank whose channels, app publisher and account rules are fully verified here.
• Mobile banking apps compared — ratings and features, once you know the app is genuine.
• Personal account opening by bank — set the security options up on day one.
• Best banks for foreigners in Guatemala — which banks accept which immigration status.
• How to open a Banrural account — the bank with the per-channel blocking hours above.
• USD accounts in Guatemala compared — splitting balances across institutions.
• International wire transfers — sending larger amounts without exposing your main account.
• International ACH from Guatemala — good practice for larger outbound transfers.
• Wise vs Remitly for Guatemala — alternatives that keep your main account out of the transaction.
• Banks in Guatemala City — branches to walk into when a phone line is closed.
• All Guatemala banking guides — the full section index.

Primary sources, read 31 August 2026: bam.com.gt cyberfraud page · Bam contact · Banrural consultas · Banrural: how to detect phishing · BAC security advice · gtc.com.gt · Banco Promerica security advice · Bantrab security recommendations and its contact page (customer-service address, re-verified 1 September 2026) · Ficohsa: Todos Contra el Fraude · vivibanco.com.gt · corporacionbi.com · app publisher check via Google Play and the App Store. Reporting: Ministerio Público · Yo Denuncio · Superintendencia de Bancos. The Banco Industrial and SIB sites blocked automated access that day, so no current figure is quoted from either.

Last verified: 31 August 2026. Phone numbers, published hours and security pages change without notice — re-check your own bank’s contact page before you need it, and save the number with its hours.