Do not use a link or phone number included in the alert to investigate the transaction.
Open the bank's official app or use a trusted contact method and check the transaction directly.
If you did not authorise the activity, contact the bank immediately and follow its fraud or dispute process.
If you recently shared a password, OTP, card details, or banking information, tell the bank so it can assess the wider risk.