A bank alert says an unfamiliar device tried to sign in. You reach for the message because restoring normal access feels like the sensible next step.
The page that follows even offers a familiar number keypad. Before using it, check who is asking for your banking information and why.
Overview
An unknown-device warning that asks you to restore access
The Rawbank login attempt email scam claims an unfamiliar device tried to access the recipient’s account. It says security restrictions have been applied.
The message then offers a button to restore access. This makes an account problem the reason to follow a route chosen by the sender.
Rawbank is a legitimate bank. The warning described here is an impersonation attempt, not a genuine account restriction established by the bank.
A French login form with a scrambled PIN keypad
The reported link leads to valenciamakeovers[.]com, where a copied Rawbank-style page requests a username and personal PIN. An on-screen keypad rearranges the numbers.
Those visual details are designed to feel like banking security. They do not establish that Rawbank receives the information entered into the form.
The central risk is disclosure of online-banking credentials. The exact permissions, authentication requirements, and outcome depend on the real account involved.
The right response starts with the genuine bank
Check account status through your usual banking route, not the email’s restore button. Useful warning signs include:
- An unexpected security claim that immediately redirects the response.
- A banking login appearing on a domain unrelated to the established service.
- A request for a real username and personal PIN under a protective explanation.
- A familiar keypad being used as reassurance about an unverified page.
- Pressure to repair access before checking whether it is actually restricted.
The email illustration uses invented addresses. It explains the warning’s approach without presenting a generated image as an authentic Rawbank message.
Why a Scrambled Keypad Can Be Persuasive
A page that asks only for an ordinary password may be easier to question. A specialized banking control can feel more difficult for a stranger to imitate.
The shuffled digits encourage that impression. You have to look at the page and choose the right numbers, making the interaction feel deliberate and secure.
But the owner of a counterfeit form controls its buttons too. Avoiding your physical keyboard does not prevent that page from knowing which digits you select.
This does not mean every on-screen keypad is fraudulent or useless. It means the keypad cannot authenticate the website that displays it.
The important question comes first: did you reach the bank through a trusted route? A copied control on an unrelated page cannot answer that question.
French wording can provide another layer of familiarity for the intended audience. Correct language and recognizable terms make the form easier to use, not more authoritative.
A person may also assume a random commercial domain could not host anything dangerous. In reality, a webpage’s content must be assessed separately from its site’s ordinary business.
Do not accuse that business of operating the scam without evidence. For the banking customer, the immediate decision is simpler: do not enter bank secrets there.
How the Rawbank Login Attempt Email Scam Works
Step 1: The email invents a security event you want to resolve
The message claims an unknown device attempted a login and that the bank blocked it. This gives the recipient both a reason for concern and apparent reassurance.
The bank supposedly noticed the danger already. The reader is encouraged to believe the email belongs to the protective response rather than the attack.
That framing matters because the requested action can feel responsible. You are not chasing a prize; you believe you are securing money you already have.
Still, a description of a blocked attempt does not establish a real event. Check the actual account rather than letting the warning define what happened.
Step 2: A restriction claim creates a reason to use the button
The email says access is restricted, then offers restoration. The sender supplies the alleged problem and its convenient solution together.
If you have recently experienced an ordinary sign-in error, the story may seem especially plausible. A coincidence can make a general campaign feel personally informed.
Do not enter information merely to discover whether you are locked out. Open the banking service you normally use and assess its real status.
If that service genuinely reports a problem, contact the bank through existing details. A real restriction still does not authorize an unrelated email link.
Step 3: The destination borrows the bank’s sign-in appearance
The reported page uses Rawbank-style branding on valenciamakeovers[.]com. The domain’s ordinary homepage currently presents a beauty-services business rather than a banking portal.
A normal homepage does not explain who placed a different page elsewhere on the site. Nor does it prove that an earlier credential form was harmless.
The site owner’s knowledge or involvement is not independently established here. Keep the accusation attached to the counterfeit banking page rather than guessing about ownership.
No credential entry is needed to test the mismatch. Use the genuine bank’s login route instead of investigating by trial and error.
Step 4: Username and PIN collection are disguised as normal authentication
The French form asks for an identifier and a personal PIN through the shuffled keypad. Familiar presentation can make the user concentrate on entering everything correctly.
That concentration can push the website address into the background. The recipient may worry about making a mistake instead of questioning who receives the digits.
Anything entered into an untrusted form should be treated as potentially disclosed. An error, blank response, or failed restoration does not demonstrate that the page discarded it.
If you used the form, remember which type of credential it was. An online-banking PIN should not automatically be described as your payment-card PIN.
Step 5: The operator can try the information against real banking access
Captured credentials can support unauthorized access attempts. Whether an attempt succeeds depends on the genuine account’s controls and any additional factor supplied by the customer.
The report does not establish a successful transfer from every affected account. There is no reason to wait for a visible loss before informing the bank.
If another prompt appears later, read what it actually authorizes. Do not approve a new device, payment, or account change because someone calls it access restoration.
The bank needs a precise explanation of the exposure so it can assess the right protections. “I clicked a link” may omit the more important PIN disclosure.
Checking a Security Alert Without Missing a Real Problem
Use your existing banking application or saved address
Begin with the route you used before the warning arrived. Do not copy a website address out of the email and treat that as independent navigation.
Check real account messages and recent activity. If access works, you can assess whether any genuine issue needs attention without using the restoration form.
A working account is not proof that disclosed credentials are safe. An intruder may not have used them yet, or an attempt may have been blocked.
Report exposure separately from service status. These are related questions, but they do not have the same answer.
Contact the bank through a known relationship
Use established branch details, trusted banking records, or Rawbank’s official contact page. Do not call a number introduced by the suspicious conversation.
Explain that a restore-access link requested your online identifier and PIN. Tell the bank whether another approval or code was involved.
There is no need to reveal the PIN to prove the problem occurred. Genuine support needs the nature of the exposure, not another copy of your secret.
If a purported bank employee calls afterward, you can disconnect and reconnect independently. Knowing about the alert is not proof they work for Rawbank.
Review transactions and access as separate checks
An account can have suspicious access without a completed payment. Conversely, a disputed transfer requires urgent financial handling in addition to a password or PIN change.
Identify transactions you do not recognize and let the bank determine their status. Do not initiate a matching transfer to test whether the account still works.
Where another authorized person uses the account, confirm legitimate activity through an established contact. Avoid assuming every unfamiliar entry is fraud.
Ask the bank which security and support routes apply to your account. Save those details somewhere you can reach without reopening the suspicious email.
What to Record Before the Details Become Blurred
Save the original email and note when you opened the link. Record whether you typed, clicked keypad digits, approved anything, or downloaded a file.
Keep the destination from the original message for private reporting. Do not revisit it to create a better screenshot of a credential-collection page.
If the form rejected your first entry and you tried another credential, tell the bank both were involved. Multiple attempts can widen the exposure.
Include keypad clicks even if you never pressed a final confirmation button. A webpage can process selections as you make them, before displaying a submitted result.
You do not need to reconstruct the digits for the bank. Explain that the real online PIN was entered into an untrusted form.
If you used only an invented test value, say that accurately. The response should distinguish a real secret from a meaningless entry without encouraging further tests.
Also note which device you used. This helps separate the account investigation from any software or browser issue that may need examination on that device.
Do not publish screenshots containing identifiers or account details. The bank or investigator may need private evidence that should not become part of a public warning.
No executable or device compromise is established by this email alone. A separate installation or permission request would need its own assessment.
What to Do If You Fell Victim
Leave the copied banking page. Do not retry the keypad, provide a second credential, or follow a new message claiming the restoration was incomplete.
If you only read the notice, report it and check the account normally. Receiving an impersonation email does not itself expose a banking PIN.
Tell Rawbank immediately about shared banking access. Use the genuine contact route and identify exactly which credential type, code, or approval was supplied.
Ask which protective restrictions or replacements apply. If access is blocked, let the bank handle recovery rather than attempting another route from the fraudulent email.
Review actual activity with the bank. Flag unfamiliar transactions, new access, and unexplained account changes. Preserve references and timestamps instead of relying on memory.
If money moved, request urgent investigation. Do not accept a stranger’s promise that another transfer is needed to reverse the first one.
Replace exposed credentials through an authorized process. Follow Rawbank’s instructions for the affected online-banking identity. Change unrelated services too if you reused a disclosed secret.
Use a trusted device after any suspected software installation. Do not assume a card replacement alone resolves an exposed online-banking login.
Report and retain the original warning. Send it through the bank’s or your workplace’s approved process. Keep any bank case number and subsequent incident records.
Where financial loss or identity misuse occurred, ask about an appropriate police report. Reporting should accompany account protection, not postpone it.
Check the device if additional software was involved. Malwarebytes can assist with suspicious programs or extensions actually installed during the encounter.
AdGuard may help reduce malicious advertising and known risky destinations. It cannot revoke a banking session, replace a PIN, or recover funds already transferred.
Expect a second approach. Refuse callers who ask for another approval to finish the security repair. Reconnect with your bank independently whenever the request is unexpected.
Keep a trusted person informed if the incident feels overwhelming. Fast, specific reporting is more useful than trying to resolve embarrassment privately.
Is Your Device Infected? Run a Free Malware Scan
Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.
The free version detects and removes the most common threats, including:
- Adware — the cause of those annoying pop-ups
- Browser hijackers — unwanted redirects and changed homepages
- Trojans and spyware — hidden programs stealing your data
- Potentially unwanted programs (PUPs) — software you never asked for
👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.
Run a Malware Scan with Malwarebytes for Windows
Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.
Download Malwarebytes
Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.
Download MalwarebytesOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium
Malwarebytes Free for WindowsScans and removes malware at no cost-
Install Malwarebytes
When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The setup wizard will walk you through a few quick screens:
-
Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.
-
Malwarebytes will now install on your device. This usually takes under a minute.
-
When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.
-
On the final screen, click Open Malwarebytes to launch the program.
-
Enable “Scan for Rootkits”
Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.
In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.
Done? Click “Dashboard” in the left pane to return to the main screen.
Start the Scan
Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.
-
Wait for the Scan to Finish
The scan checks your entire system for browser hijackers and other malicious programs, so it can take 5 to 20 minutes depending on your computer. Feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.
Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.
-
Restart Your Computer
Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, Malwarebytes has finished removing the threats it found.
That’s it — your Windows PC is now clean of trojans, adware, and other malware, and should be back to running smoothly.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:
- Run a computer scan with ESET Online Scanner
- Ask for help in our Windows Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Mac
Malwarebytes for Mac is a free on-demand scanner that removes the malware other security software tends to miss — adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it’s our go-to recommendation. Follow the steps below to scan and clean your Mac in just a few minutes.
-
Download Malwarebytes for Mac
Click the button below to download the latest version of Malwarebytes for Mac.
Download MalwarebytesOfficial installer for macOS. Your download starts right away.Want real-time protection? See Malwarebytes PremiumMalwarebytes Free for MacScans and removes malware at no cost -
Open the Malwarebytes setup file
When the download finishes, open your Downloads folder and double-click the setup file to begin the installation.
-
Follow the On-Screen Prompts to Install Malwarebytes
The Malwarebytes for Mac Installer will guide you through a few quick screens. Click “Continue” and keep following the prompts until the installation completes.
When the installation is complete, Malwarebytes opens to the Welcome to Malwarebytes screen. Click “Get started“.
-
Select “Personal Computer” or “Work Computer”
Malwarebytes will ask what type of computer you’re installing it on. Click either Personal Computer or Work Computer, whichever applies.
-
Start the Scan
Click the “Scan” button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.
-
Wait for the Scan to Finish
Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found. Click the “Quarantine” button to remove all the threats at once.
-
Restart Your Mac
Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot — if Malwarebytes asks you to restart, allow it. Once you’re logged back in, your Mac is clean.
That’s it — your Mac is now free of adware, rogue browser extensions, and other potentially harmful software.
If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Android
Malwarebytes for Android automatically detects and removes dangerous threats like malware and ransomware so you don’t have to worry about your most-used device being compromised. Aggressive detection of adware and potentially unwanted programs keeps your Android phone or tablet running smooth.
-
Download Malwarebytes for Android.
You can download Malwarebytes for Android by clicking the link below.
Get Malwarebytes for AndroidOpens Google Play in a new tab.Want real-time protection? See Malwarebytes Premium for AndroidMalwarebytes for AndroidScans your phone and removes malware at no cost -
Install Malwarebytes for Android on your phone.
In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.
When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
-
Follow the on-screen prompts to complete the setup process
When Malwarebytes will open, you will see the Malwarebytes Setup Wizard which will guide you through a series of permissions and other setup options.
This is the first of two screens that explain the difference between the Premium and Free versions. Swipe this screen to continue.
Tap on “Got it” to proceed to the next step.
Malwarebytes for Android will now ask for a set of permissions that are required to scan your device and protect it from malware. Tap on “Give permission” to continue.
Tap on “Allow” to permit Malwarebytes to access the files on your phone.
-
Update database and run a scan with Malwarebytes for Android
You will now be prompted to update the Malwarebytes database and run a full system scan.
Click on “Update database” to update the Malwarebytes for Android definitions to the latest version, then click on “Run full scan” to perform a system scan.
-
Wait for the Malwarebytes scan to complete.
Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
-
Click on “Remove Selected”.
When the scan has been completed, you will be presented with a screen showing the malware infections that Malwarebytes for Android has detected. To remove the malicious apps that Malwarebytes has found, tap on the “Remove Selected” button.
-
Restart your phone.
Malwarebytes for Android will now remove all the malicious apps that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your device.
That’s it — your Android phone is now clean — no more malicious apps, adware, or browser redirects.
If you are still having problems with your phone after completing these instructions, then please follow one of the steps:
- Restore your phone to factory settings by going to Settings > General management > Reset > Factory data reset.
- Ask for help in our Mobile Malware Removal Help & Support forum.
Stay Protected: Block Ads and Malicious Sites
Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.
We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.
👉 Download AdGuard and browse safely
Frequently Asked Questions
Did Rawbank really block an unfamiliar device?
The email’s claim is not a verified account event. Check the genuine banking service or contact Rawbank independently to find out whether anything actually happened.
Does the scrambled keypad protect me on a fake page?
No. The operator controls the counterfeit form and its buttons. Shuffled numbers do not authenticate the website receiving your entries.
Is the online-banking PIN necessarily my card PIN?
No. Describe the credential you actually entered to the bank. Different banking credentials can protect different functions and require different recovery steps.
Does the unrelated site’s homepage prove its owner ran the scam?
No. The reported phishing use does not independently establish the owner’s involvement. Reject the banking form without making unsupported claims about the ordinary business.
Should I wait until an unauthorized transfer appears?
No. Inform the bank promptly after credential or approval exposure. Preventive account action may be important even before any unfamiliar payment is visible.
Can a device scan secure my banking login?
A scan can investigate local software, not replace bank-led recovery. Disclosed credentials and accepted approvals require attention through the genuine financial institution.
The Bottom Line
Do not restore Rawbank access through this email or enter a PIN on its copied page. The security story and shuffled keypad do not authenticate the destination.
If you responded, contact the real bank, explain the precise information or approval involved, and review account activity. Handle any actual device exposure separately.
Join the discussion
0 commentsShare your experience or ask a question about this article.
Discussion
Start the conversation
Have a question or something useful to share? Add the first comment.