The ones we're getting around here are "alert" texts from the fraud department of our banks, with the genuine number spoofed as the sender. Looks JUST like the real thing. Then some verbiage about "please confirm Y/N whether you've used your debit card in the last XX hours/days."

Still pretty much how the real thing works.

Then comes the trap: "please enter your PIN to confirm"

HELLs to the no!

In the real deal, it would say "please call our fraud line at the number listed on the back of your card."