Israeli Scam Detector

Israeli Scam Detector

Legal notice

This skill is not legal advice, not a substitute for a licensed lawyer, and not a security guarantee. It explains published Israeli law and official guidance so you can act quickly, but it cannot tell you how a bank or a court will decide your particular case. It does not verify messages on your behalf and cannot confirm that any message is safe.

Where the law is unsettled, this skill says so rather than guessing. If money is involved, contact your bank immediately and consider consulting a lawyer. The National Cyber Directorate states that any senior citizen over 65 who fell victim to exploitation or economic abuse may approach the Ministry of Justice legal aid and receive *free legal advice and representation, at 6405.

Problem

Nearly every Israeli guide to card fraud still cites חוק כרטיסי חיוב, a law that was repealed in 2020, and tells victims the bank has 30 days to refund them and that they must file a police report first. Both are wrong under the law that actually governs, and both cost the victim time during the only window that matters. Meanwhile the identification advice everyone repeats, check who the sender is, was disowned by the Ministry of Communications itself, and forged messages now land inside the genuine message thread of GOV.IL and of real companies.

The people hit hardest are the ones least served by that bad advice. The Bank of Israel, Israel Police and the Ministry of Communications jointly found that fraud targets everyone but concentrates on people with low financial and digital literacy, and the Bank of Israel amended a banking directive's explanatory notes to flag Russian speakers, after public consultation raised that fraud is prevalent among them.

Instructions

Work in this order. The order is the point: the first step stops the bleeding and every later step depends on having done it.

Step 0: Ask the one question that decides everything else

Before quoting any deadline, establish which of these happened. They are governed by different rules, and confusing them is the most damaging mistake this skill can make.

Why this matters, and why it is not a technicality. Chapter ו' is headed "שימוש לרעה באמצעי תשלום", and s.1 defines שימוש לרעה as use of the instrument "בידי מי שאינו זכאי לכך לפי חוזה שירותי התשלום", meaning use by someone not entitled under the contract. A person deceived into making their own transfer is entitled under the contract. So the ₪75 plus ₪30 per day ladder, the ₪450 cap and the eight-business-day refund do not reach that case at all.

Quoting an eight-business-day refund entitlement to someone in situation B sends them to their bank with a demand the bank will correctly refuse, and costs them the hours in which situation B is actually still winnable. Never state that entitlement before you know which situation you are in.

If both happened, run both branches.

Situation C is the cheapest to win and the most often missed. Notice is not something you give after a charge appears: s.24(א) defines הודעה as notice about "גניבה או אבדן של רכיב חיוני" or misuse, so it is available with nothing charged. Do not quote the ₪75 + ₪30/day ladder here: where the user handed the component over, s.24(ד) opens "על אף הוראות סעיף קטן (ג)" and disapplies the cap, which is the very question Step 3 says is untested. That is the argument for speed, not against it, because s.24(ב) is unqualified and ends liability for misuse after notice however s.24(ד) falls. Notice before the first charge is the one move that works whichever way the untested point goes. Say "נגנב לי רכיב חיוני, אני מוסר הודעה", and ask to freeze the instrument (s.25(ב) zeroes liability for the frozen period too).

Step 1A: Unauthorised use. Call the bank NOW

Do this before reading anything else, before calling the police, and before gathering evidence.

Under section 24 of חוק שירותי תשלום, התשע"ט-2019, the payer's liability before notice is the lower of two amounts: a fixed ₪75 plus ₪30 for every day counted from the day the payer learned of the theft, loss or misuse until notice is given, or the amount actually transacted. If notice is given within 30 days of the first misuse, liability is capped at ₪450. The day of notice is excluded from the count when notice is given the same day the person found out.

Two consequences that change behaviour:

• The ₪30 per day clock starts from the moment you knew, not from the fraud. Every day of hesitation has a price.
• After notice is given, liability for further misuse is zero (s.24(ב)). Notice is the switch.

"Notice" in the statute means notice to the payment service provider, meaning your bank or card issuer. The word משטרה does not appear anywhere in the law. Telling the police does not start any clock in this statute.

The bank must answer, and you can say so. Since 31 May 2026, הוראת ניהול בנקאי תקין 426 requires every banking corporation to provide a professional human telephone answer for suspected payment fraud, available around the clock, every day of the week, including during the weekly rest hours. As a rule the wait must not exceed six minutes.

Ask for what you are owed:

Find the number yourself: on the back of your own card, or by opening the bank's app or typing its address yourself. Never use a number that came from the message or from the person who called you.

Same-day, not "the day after": unauthorised direct debits. If the loss came through a הרשאה לחיוב, s.35 runs a far shorter clock than card misuse. A specific charge can be cancelled by notice within 3 business days of the charge, and must be refunded within 1 business day of that notice. Raise it on the same call, because three business days disappear quickly.

Step 1B: A transfer you were talked into. Speed at the other end is the only lever

Say plainly that the statutory refund clock does not apply here, then move immediately to what does work. This branch is won or lost in hours, so do not spend them arguing about entitlement.

1. Call the bank now and ask for an immediate recall to the beneficiary bank. Use the words "בקשת החזרת כספים" and ask them to contact the receiving bank directly. The money is only recoverable while it is still sitting in the beneficiary account. First establish whether it has actually been executed yet: some Israeli retail transfers settle immediately and some are queued to the next business day, so ask rather than assume. If it has not executed, this is not a favour: s.16(א)(1) lets the payer cancel a payment order while the provider can still stop it, and s.16(ב) then obliges it to halt execution "מיד עם קבלת ההודעה". The cut-off is whatever the payment services contract states, which s.16(ג) requires it to disclose. Once the order has executed there is no statutory recall window, and a recall is a request the bank owes you nothing on.
2. Get the beneficiary details in writing: account number, bank, branch, and the name on the account. If the bank declines on privacy grounds, do not stall there: ask the police to obtain them, and move straight on to the report.
3. Report to the police with those beneficiary details, so the account can be frozen. Here, unlike in branch A, the police step is time-critical rather than administrative, because freezing the destination account is a police action and not a bank one.
4. If the money went to a crypto exchange or a payment app, contact that provider in parallel. They freeze on their own terms and usually faster than any bank.
5. Ask the bank to open a case in writing and record the reference number.

If the bank ignored its own anomalous-transaction monitoring, that is a separate claim against the bank, not a recall. Preserve it for Step 6A, but do not lead with it: leading with it delays the only step that is still time-critical.

Be honest about the odds without being defeatist: recovery depends on whether the money is still there, which is why every hour matters. Do not promise it, and do not tell the user it is hopeless either. Tell them what to do in the next hour.

Step 2: Deadlines that follow, in branch A only

• Refund: 8 business days. Section 27(א) requires the provider to refund the charge, less the amount owed under s.24(ג), as soon as possible and no later than eight business days from the day of your notice. If someone tells you thirty days, they are quoting the repealed law.
• Re-debit: 15 days' warning. The bank may reverse the refund if it concludes the case falls under s.24(ד) or s.26, but s.27(ב) requires written reasons at least 15 days before the actual debit, and it must give you copies of its documents on request. That window and those documents are your opening to contest. The warning may be simultaneous only where the payer acted fraudulently.

Step 3: Where the law is unsettled, in branch A only

This step is branch A only. Section 24(ד) presupposes a שימוש לרעה, so it has nothing to say about a transfer the user gave themselves. If you are in branch B, skip to Step 4; the question of whether the user is "covered" does not arise, because chapter ו' never applied.

Within branch A: if the person was deceived into handing over a code, a card detail or a password, do not tell them whether they are covered. Explain the position:

Section 24(ד) removes the liability cap when the payer made the רכיב חיוני available to another person, and it applies "בין שהשימוש נעשה בידיעת המשלם ובין שנעשה שלא בידיעתו". It lists exactly two carve-outs: handing it over in reasonable circumstances for safekeeping only or to a payee to initiate a payment, and cases where it was then stolen from or lost by that person. Being tricked is not among the listed carve-outs, and no case law was located resolving how this applies to someone deceived into disclosing a one-time code.

So: state the text, state that the point is untested, and still give the action. Being unable to say "you are covered" never excuses failing to say "call the bank now, the clock is running."

Name the likely first answer, and label it as first, not final. Say something close to: "I cannot promise you an outcome. The bank's first answer may well be that you are responsible because you gave the code. That is the first answer, not the last one." Section 27(ב) expressly permits the provider to re-debit if it concludes s.24(ד) applies, so a refund arriving is not the end of the matter either. Tell the user to plan for both: keep every record, demand the written reasons the section requires, use the 15 days before any debit, and escalate (Step 6A). Refusing to predict the outcome is honest. Letting the user assume it will be fine is not.

Step 4: Judge the message, using tests that actually work

Apply these in order. The first two are the ones that matter.

1. Did you initiate contact? If you did not open the app or dial the number yourself, treat every detail in front of you as attacker-controlled, including the sender name, the logo, the thread it sits in, and any number it tells you to call.
2. Verify on a channel you navigated to yourself. Type the address, open the app you already have, or call the number on your own card. This single habit defeats nearly every pattern below.
3. Check the domain, where the body publishes one. Israel Post states that genuine messages show only postil.co.il or israelpost.co.il, and that any change of address means impersonators. Bituach Leumi states its address always ends in Gov.il.
4. Check the organisation's own inbox. Bituach Leumi notifies in the personal area under ׳מכתבים׳; most banks and government services do the same. A real notice usually exists in two places.
5. Apply the never rules. A real representative of a bank, the police or a government body will not ask you by phone for a one-time code, a password, card details, or a photo of a personal document. Bituach Leumi does not ask for card details in order to pay you benefits. Generalise it: a body that owes you money never needs your card number.
6. Treat three demands as decisive. Being asked to install an app, click a link or share your screen; being asked to move money to a "safe account"; and being asked to keep the call secret ("אל תספר לאף אחד", "זה דחוף"). Each is a documented pressure tactic, not a coincidence.

Two tests that do NOT work, and why:

• The sender name proves nothing. The Ministry of Communications decided in 2020 that it does not regard Latin letters in the SMS CLI field as a one-to-one identifier of a subscriber, and that a user receiving a message with a textual sender name should exercise judgment about the source. It went further, saying the concept of forgery is not even relevant to an alphabetic CLI because it is not a unique identifier in the first place.
• The thread proves nothing. The National Cyber Directorate has warned that impersonating messages appear inside the existing genuine thread of GOV.IL, and separately of Pango, and explained this exploits how certain handsets group messages rather than any breach.

This is why this skill does not publish a list of legitimate sender names. Such a list would train exactly the check that the attack defeats.

Step 5: Match the pattern

The joint Bank of Israel, Israel Police and Ministry of Communications task force focuses on three patterns. Use them as the top-level triage.

Add the 2026 AI layer:

• A cloned voice of a relative or a manager asking for an urgent transfer. The countermeasure is social and must be arranged in advance: a family code word for emergencies known only to the family, and a callback on the number you already have. The National Cyber Directorate's rule is "לא פועלים מתוך לחץ. מנתקים ומתקשרים לבן משפחה במספר המוכר", under the heading עוצרים, מנתקים, מאמתים: stop, hang up, verify.
• Deepfake video calls. Looking and sounding right is no longer evidence of identity.
• Deepfake investment videos using the faces of well-known Israeli finance figures. Attribute these warnings to מערך הסייבר, not to רשות ניירות ערך.

Step 6: Report, with honest expectations about each route

Step 6A: If the bank refuses, escalate in this order

A statute the user cannot enforce is worth nothing, so give them the ladder:

1. The bank's own פניות הציבור, in writing. Written is not optional: an oral phone notice is exactly what gets disputed later. Reference the section you are relying on.
2. Bank of Israel פניות הציבור, if the bank's answer is unsatisfactory or absent.
3. תביעות קטנות (small claims court), which needs no lawyer and is the right forum for a four-figure loss. israeli-small-claims-court covers the procedure.

Step 7: The day after

• Block the card, and notify both the bank and the card company.
• Hunt for unfamiliar new standing orders (הוראות קבע) and direct debits. This is the step people skip, and it bleeds money for months.
• Sweep for credit taken in the user's name. Anyone holding a one-time code and account access routinely goes further than a single charge: check for a new digital loan, a raised card limit, a newly enrolled device, and whether the phone number or email on the account was changed. Force a device de-enrolment and a full credentials reset.
• Preserve evidence before tidying up. Do not delete the SMS, the call log or the chat. Screenshot the transaction, the beneficiary details and the calling number. Get the bank's confirmation of your notice in writing, by email or in-app message.
• Turn on purchase alerts, change reused passwords, enable two-factor authentication.
• If ID details were exposed, note that replacing a stolen תעודת זהות does not require a police complaint; a תצהיר suffices. There is no Israeli equivalent of a US fraud alert, so ask the credit data register (מאגר נתוני אשראי) at the Bank of Israel what options actually exist here.

Step 8: Helping someone else

When the user is helping a parent or grandparent, lead with the two entitlements rather than generic advice. Senior queue priority is genuinely demandable, from a bank, for someone aged 70 or over. Russian-language service is worth asking for but is an expectation the regulator voiced, not a duty, so do not promise it. Then set up the family code word, save the bank's real fraud number in the person's phone under a name they will recognise, and agree the rule that nobody in the family ever asks for money by message or by a call the other person did not initiate.

Reassure them about one thing specifically: the National Cyber Directorate has stated that merely answering the call does not harm the phone. Elderly users who believe otherwise often stop answering every call, including the bank's callback.

If the user writes in Russian, answer in Russian.

Gotchas

These are failure modes for the agent, not for the user.

• Never quote the refund clock before running Step 0. This is the biggest trap in the domain. Chapter ו' reaches only שימוש לרעה, defined as use by someone NOT entitled under the payment services contract. A victim talked into transferring money from their own app was entitled, so the ladder, the cap and the eight-business-day refund do not apply to them. Every figure in Step 1A is correct and none of it is applicable to branch B. Correct and applicable are different questions, and only Step 0 answers the second one.

• Do not assume the user is the account holder. Joint accounts, business accounts and a relative helping a parent each change who may give notice and whether the consumer liability regime reaches the account at all. Ask whose account it is, and if it is a company account or the user is not the holder, say the position may differ and route them to the bank and a lawyer rather than guessing.

• Do not cite חוק כרטיסי חיוב. It is repealed outright by s.55 of חוק שירותי תשלום. Its numbers survive in circulation and look right, which is exactly why the citation slips through. The live provisions are ss.24 and 27 of the 2019 law. Quoting the dead statute to a bank forfeits the user's credibility at the moment they need it.

• Do not repeat "the bank has 30 days". That was the repealed regime. It is 8 business days, and repeating the old figure hands the bank three weeks the user is entitled to.

• Do not tell the user to go to the police first. It feels responsible and it is wrong: no clock in the statute is triggered by a police report, while the ₪30 per day clock keeps running.

• Do not repeat "check the sender name", even though official bodies say it. Bituach Leumi's own page lists it, and it is not sufficient on its own; the Ministry of Communications has ruled that an alphabetic sender ID is not a unique identifier. Present the domain check, the personal-area check and the independent callback as the load-bearing tests. Do not describe Bituach Leumi as wrong; its other rules are sound.

• Never say a message is safe. The skill has no way to verify one. When it cannot confirm, it must still give the action: do not click, and verify through a channel you opened yourself.

• Do not state that Israel Post never sends SMS. Customs-payment notifications are a genuine Post service. The overstatement is dangerous because it teaches users to distrust a real message and to trust the next forgery that mimics a denial.

• Keep the attributions apart. The SMS-in-genuine-thread warnings come from the National Cyber Directorate's official Telegram channel and have no gov.il permalink; say so. Deepfake warnings about Israeli finance figures come from מערך הסייבר, not from רשות ניירות ערך.

• Never tell a user to pay whoever took their account. Paying an account hijacker or a sextortion demand buys nothing and marks the user for repeat targeting. For a hijacked WhatsApp the documented route is self-service re-verification, then reporting to WhatsApp, and it never involves payment. See references/reporting-routes.md.

• Do not answer the deceived-OTP question. Section 24(ד) is untested on that point. State the text, state the uncertainty, give the action.

Recommended MCP Servers

Do not reach for a bank-scraping MCP here. A user who has just been defrauded should not be wiring new access to their accounts, and this skill never needs to read their transactions.

Reference Links

Bundled Resources

Troubleshooting