israeli-scam-detector

Israeli Scam Detector

Legal notice

This skill is not legal advice, not a substitute for a licensed lawyer, and not a security guarantee. It explains published Israeli law and official guidance so you can act quickly, but it cannot tell you how a bank or a court will decide your particular case. It does not verify messages on your behalf and cannot confirm that any message is safe.

Where the law is unsettled, this skill says so rather than guessing. If money is involved, contact your bank immediately and consider consulting a lawyer. The National Cyber Directorate states that any senior citizen over 65 who fell victim to exploitation or economic abuse may approach the Ministry of Justice legal aid and receive *free legal advice and representation, at 6405.

Problem

Nearly every Israeli guide to card fraud still cites the Payment Cards Law, a law that was repealed in 2020, and tells victims the bank has 30 days to refund them and that they must file a police report first. Both are wrong under the law that actually governs, and both cost the victim time during the only window that matters. Meanwhile the identification advice everyone repeats, check who the sender is, was disowned by the Ministry of Communications itself, and forged messages now land inside the genuine message thread of GOV.IL and of real companies.

The people hit hardest are the ones least served by that bad advice. The Bank of Israel, Israel Police and the Ministry of Communications jointly found that fraud targets everyone but concentrates on people with low financial and digital literacy, and the Bank of Israel amended a banking directive's explanatory notes to flag Russian speakers, after public consultation raised that fraud is prevalent among them.

Instructions

Work in this order. The order is the point: the first step stops the bleeding and every later step depends on having done it.

Step 0: Ask the one question that decides everything else

Before quoting any deadline, establish which of these happened. They are governed by different rules, and confusing them is the most damaging mistake this skill can make.

Ask the user	Which situation
"Did someone else use your card or account details?" (a charge you did not make, a card used by the scammer, details taken and used)	A. Unauthorised use. Chapter ו' of the Payment Services Law applies. Go to Step 1A.
"Or did you move the money yourself, in your own app or at the bank, because someone talked you into it?"	B. A transfer you gave. Chapter ו' does not apply. Go to Step 1B.
"Have you given card details, a password or a one-time code, but nothing has been charged yet?"	C. A component is compromised, no misuse yet. Still Step 1A, and go now. See below.

Why this matters, and why it is not a technicality. Chapter ו' is headed "Misuse of a Payment Instrument", and s.1 defines misuse as use of the instrument "by someone not entitled to do so under the payment services contract", meaning use by someone not entitled under the contract. A person deceived into making their own transfer is entitled under the contract. So the ₪75 plus ₪30 per day ladder, the ₪450 cap and the eight-business-day refund do not reach that case at all.

Quoting an eight-business-day refund entitlement to someone in situation B sends them to their bank with a demand the bank will correctly refuse, and costs them the hours in which situation B is actually still winnable. Never state that entitlement before you know which situation you are in.

If both happened, run both branches.

Situation C is the cheapest to win and the most often missed. Notice is not something you give after a charge appears: s.24(a) defines notice as notice about "theft or loss of an essential component" or misuse, so it is available with nothing charged. Do not quote the ₪75 + ₪30/day ladder here: where the user handed the component over, s.24(ד) opens "notwithstanding the provisions of subsection (c)" and disapplies the cap, which is the very question Step 3 says is untested. That is the argument for speed, not against it, because s.24(ב) is unqualified and ends liability for misuse after notice however s.24(ד) falls. Notice before the first charge is the one move that works whichever way the untested point goes. Say "an essential component was stolen from me, I am giving notice", and ask to freeze the instrument (s.25(ב) zeroes liability for the frozen period too).

Step 1A: Unauthorised use. Call the bank NOW

Do this before reading anything else, before calling the police, and before gathering evidence.

Under section 24 of the Payment Services Law, 5779-2019, the payer's liability before notice is the lower of two amounts: a fixed ₪75 plus ₪30 for every day counted from the day the payer learned of the theft, loss or misuse until notice is given, or the amount actually transacted. If notice is given within 30 days of the first misuse, liability is capped at ₪450. The day of notice is excluded from the count when notice is given the same day the person found out.

Two consequences that change behaviour:

The ₪30 per day clock starts from the moment you knew, not from the fraud. Every day of hesitation has a price.
After notice is given, liability for further misuse is zero (s.24(ב)). Notice is the switch.

"Notice" in the statute means notice to the payment service provider, meaning your bank or card issuer. The word police does not appear anywhere in the law. Telling the police does not start any clock in this statute.

The bank must answer, and you can say so. Since 31 May 2026, Proper Banking Management Directive 426 requires every banking corporation to provide a professional human telephone answer for suspected payment fraud, available around the clock, every day of the week, including during the weekly rest hours. As a rule the wait must not exceed six minutes.

Ask for what you are owed:

If the caller is	Say this
A senior citizen	Directive 426 binds a banking corporation only (s.3(א); s.3(ב) repealed). Against a bank it is a binding duty, and s.7 covers a card the bank itself issued. A standalone issuer (Max, Isracard, CAL) does not owe it, so if the card is theirs, notify them and call your bank's fraud line, where the standard does apply. Its senior citizen is age 70 by the population registry, not the 65 used for free legal aid below.
A Russian speaker	Ask for a Russian-speaking representative, but do not call it an entitlement. Russian service appears only in 426's explanatory notes, as an example of adapting service under Directive 501, because the Bank of Israel found fraud is prevalent among Russian speakers. It is the regulator's stated expectation, not an operative clause. See `references/russian-phrasebook.md`.
Unable to reach anyone at all	Note the time and how long you waited. Under s.24(ה), a payer bears no liability at all if the provider did not allow him to give notice in a reasonable manner at any time.

Find the number yourself: on the back of your own card, or by opening the bank's app or typing its address yourself. Never use a number that came from the message or from the person who called you.

Same-day, not "the day after": unauthorised direct debits. If the loss came through a debit authorization, s.35 runs a far shorter clock than card misuse. A specific charge can be cancelled by notice within 3 business days of the charge, and must be refunded within 1 business day of that notice. Raise it on the same call, because three business days disappear quickly.

Step 1B: A transfer you were talked into. Speed at the other end is the only lever

Say plainly that the statutory refund clock does not apply here, then move immediately to what does work. This branch is won or lost in hours, so do not spend them arguing about entitlement.

Call the bank now and ask for an immediate recall to the beneficiary bank. Use the words "request to return funds" and ask them to contact the receiving bank directly. The money is only recoverable while it is still sitting in the beneficiary account. First establish whether it has actually been executed yet: some Israeli retail transfers settle immediately and some are queued to the next business day, so ask rather than assume. If it has not executed, this is not a favour: s.16(א)(1) lets the payer cancel a payment order while the provider can still stop it, and s.16(ב) then obliges it to halt execution "immediately upon receipt of the notice". The cut-off is whatever the payment services contract states, which s.16(ג) requires it to disclose. Once the order has executed there is no statutory recall window, and a recall is a request the bank owes you nothing on.
Get the beneficiary details in writing: account number, bank, branch, and the name on the account. If the bank declines on privacy grounds, do not stall there: ask the police to obtain them, and move straight on to the report.
Report to the police with those beneficiary details, so the account can be frozen. Here, unlike in branch A, the police step is time-critical rather than administrative, because freezing the destination account is a police action and not a bank one.
If the money went to a crypto exchange or a payment app, contact that provider in parallel. They freeze on their own terms and usually faster than any bank.
Ask the bank to open a case in writing and record the reference number.

If the bank ignored its own anomalous-transaction monitoring, that is a separate claim against the bank, not a recall. Preserve it for Step 6A, but do not lead with it: leading with it delays the only step that is still time-critical.

Be honest about the odds without being defeatist: recovery depends on whether the money is still there, which is why every hour matters. Do not promise it, and do not tell the user it is hopeless either. Tell them what to do in the next hour.

Step 2: Deadlines that follow, in branch A only

Refund: 8 business days. Section 27(א) requires the provider to refund the charge, less the amount owed under s.24(ג), as soon as possible and no later than eight business days from the day of your notice. If someone tells you thirty days, they are quoting the repealed law.
Re-debit: 15 days' warning. The bank may reverse the refund if it concludes the case falls under s.24(ד) or s.26, but s.27(ב) requires written reasons at least 15 days before the actual debit, and it must give you copies of its documents on request. That window and those documents are your opening to contest. The warning may be simultaneous only where the payer acted fraudulently.

Step 3: Where the law is unsettled, in branch A only

This step is branch A only. Section 24(d) presupposes a misuse, so it has nothing to say about a transfer the user gave themselves. If you are in branch B, skip to Step 4; the question of whether the user is "covered" does not arise, because chapter ו' never applied.

Within branch A: if the person was deceived into handing over a code, a card detail or a password, do not tell them whether they are covered. Explain the position:

Section 24(d) removes the liability cap when the payer made the essential component available to another person, and it applies "whether the use was made with the payer's knowledge or without the payer's knowledge". It lists exactly two carve-outs: handing it over in reasonable circumstances for safekeeping only or to a payee to initiate a payment, and cases where it was then stolen from or lost by that person. Being tricked is not among the listed carve-outs, and no case law was located resolving how this applies to someone deceived into disclosing a one-time code.

So: state the text, state that the point is untested, and still give the action. Being unable to say "you are covered" never excuses failing to say "call the bank now, the clock is running."

Name the likely first answer, and label it as first, not final. Say something close to: "I cannot promise you an outcome. The bank's first answer may well be that you are responsible because you gave the code. That is the first answer, not the last one." Section 27(ב) expressly permits the provider to re-debit if it concludes s.24(ד) applies, so a refund arriving is not the end of the matter either. Tell the user to plan for both: keep every record, demand the written reasons the section requires, use the 15 days before any debit, and escalate (Step 6A). Refusing to predict the outcome is honest. Letting the user assume it will be fine is not.

Step 4: Judge the message, using tests that actually work

Apply these in order. The first two are the ones that matter.

Did you initiate contact? If you did not open the app or dial the number yourself, treat every detail in front of you as attacker-controlled, including the sender name, the logo, the thread it sits in, and any number it tells you to call.
Verify on a channel you navigated to yourself. Type the address, open the app you already have, or call the number on your own card. This single habit defeats nearly every pattern below.
Check the domain, where the body publishes one. Israel Post states that genuine messages show only postil.co.il or israelpost.co.il, and that any change of address means impersonators. Bituach Leumi states its address always ends in Gov.il.
Check the organisation's own inbox. Bituach Leumi notifies in the personal area under 'Letters'; most banks and government services do the same. A real notice usually exists in two places.
Apply the never rules. A real representative of a bank, the police or a government body will not ask you by phone for a one-time code, a password, card details, or a photo of a personal document. Bituach Leumi does not ask for card details in order to pay you benefits. Generalise it: a body that owes you money never needs your card number.
Treat three demands as decisive. Being asked to install an app, click a link or share your screen; being asked to move money to a "safe account"; and being asked to keep the call secret ("don't tell anyone", "it's urgent"). Each is a documented pressure tactic, not a coincidence.

Two tests that do NOT work, and why:

The sender name proves nothing. The Ministry of Communications decided in 2020 that it does not regard Latin letters in the SMS CLI field as a one-to-one identifier of a subscriber, and that a user receiving a message with a textual sender name should exercise judgment about the source. It went further, saying the concept of forgery is not even relevant to an alphabetic CLI because it is not a unique identifier in the first place.
The thread proves nothing. The National Cyber Directorate has warned that impersonating messages appear inside the existing genuine thread of GOV.IL, and separately of Pango, and explained this exploits how certain handsets group messages rather than any breach.

This is why this skill does not publish a list of legitimate sender names. Such a list would train exactly the check that the attack defeats.

Step 5: Match the pattern

The joint Bank of Israel, Israel Police and Ministry of Communications task force focuses on three patterns. Use them as the top-level triage.

Pattern	What it looks like	The specific move
Phone-number takeover (SIM Swap and track me)	An unrequested number-porting SMS (Hebrew term: ניוד), followed by sudden loss of cellular signal	An unrequested porting message is the attack in progress. Call the carrier from another phone immediately, then the bank. Carriers now push the OTP to the end of the porting message so the text above it is readable, so read it before the code.
Phishing via impersonating sites	A link to a page that mimics a bank or government service	Never reach a login through a link. Close it and navigate yourself.
Vishing and smishing	A call or SMS creating urgency about a debt, package, fine or grant	Hang up. Call back on a number you already hold.

Add the 2026 AI layer:

A cloned voice of a relative or a manager asking for an urgent transfer. The countermeasure is social and must be arranged in advance: a family code word for emergencies known only to the family, and a callback on the number you already have. The National Cyber Directorate's rule is "do not act under pressure. Hang up and call a family member at the known number", under the heading Stop, Hang Up, Verify: stop, hang up, verify.
Deepfake video calls. Looking and sounding right is no longer evidence of identity.
Deepfake investment videos using the faces of well-known Israeli finance figures. Attribute these warnings to the National Cyber Directorate, not to the Israel Securities Authority.

Step 6: Report, with honest expectations about each route

Route	What it is for	What it will NOT do
The bank or card issuer	Always first, but for different reasons by branch. In branch A it starts every statutory clock. In branch B no statutory clock exists; it is first because only the bank can send a recall to the beneficiary bank.	In branch B it owes you no statutory refund. Do not demand one.
119, Israel National Cyber Directorate	National CERT: triage, guidance, and taking down malicious infrastructure. Report the link so the next person does not lose money.	It does not recover your money and does not replace a police report. It does not fix computer faults.
Police, 100 or the online form	Opens a criminal case. In an emergency call 100; otherwise file online or at the station nearest your area of residence.	The online filing is a request, not a completed complaint; you may still be summoned. It does not freeze a transfer.
Hotline 105	Online harm where the victim is a minor, "ages 0-18". A parent reporting for a child is a proper caller.	Not for an adult harmed themselves, despite fraud being in its intake list.
Bank of Israel Public Inquiries	Complaints about the bank's own conduct: no answer on the fraud line, a refused refund, a re-debit without the 15 days' notice.	It does not investigate the scammer or recover money from them.

Step 6A: If the bank refuses, escalate in this order

A statute the user cannot enforce is worth nothing, so give them the ladder:

The bank's own Public Inquiries, in writing. Written is not optional: an oral phone notice is exactly what gets disputed later. Reference the section you are relying on.
Bank of Israel Public Inquiries, if the bank's answer is unsatisfactory or absent.
Small Claims (small claims court), which needs no lawyer and is the right forum for a four-figure loss. israeli-small-claims-court covers the procedure.

Step 7: The day after

Block the card, and notify both the bank and the card company.
Hunt for unfamiliar new standing orders (standing orders) and direct debits. This is the step people skip, and it bleeds money for months.
Sweep for credit taken in the user's name. Anyone holding a one-time code and account access routinely goes further than a single charge: check for a new digital loan, a raised card limit, a newly enrolled device, and whether the phone number or email on the account was changed. Force a device de-enrolment and a full credentials reset.
Preserve evidence before tidying up. Do not delete the SMS, the call log or the chat. Screenshot the transaction, the beneficiary details and the calling number. Get the bank's confirmation of your notice in writing, by email or in-app message.
Turn on purchase alerts, change reused passwords, enable two-factor authentication.
If ID details were exposed, note that replacing a stolen ID card does not require a police complaint; an affidavit suffices. There is no Israeli equivalent of a US fraud alert, so ask the credit data register (Credit Data Register) at the Bank of Israel what options actually exist here.

Step 8: Helping someone else

When the user is helping a parent or grandparent, lead with the two entitlements rather than generic advice. Senior queue priority is genuinely demandable, from a bank, for someone aged 70 or over. Russian-language service is worth asking for but is an expectation the regulator voiced, not a duty, so do not promise it. Then set up the family code word, save the bank's real fraud number in the person's phone under a name they will recognise, and agree the rule that nobody in the family ever asks for money by message or by a call the other person did not initiate.

Reassure them about one thing specifically: the National Cyber Directorate has stated that merely answering the call does not harm the phone. Elderly users who believe otherwise often stop answering every call, including the bank's callback.

If the user writes in Russian, answer in Russian.

Gotchas

These are failure modes for the agent, not for the user.

Never quote the refund clock before running Step 0. This is the biggest trap in the domain. Chapter 6 reaches only misuse, defined as use by someone NOT entitled under the payment services contract. A victim talked into transferring money from their own app was entitled, so the ladder, the cap and the eight-business-day refund do not apply to them. Every figure in Step 1A is correct and none of it is applicable to branch B. Correct and applicable are different questions, and only Step 0 answers the second one.
Do not assume the user is the account holder. Joint accounts, business accounts and a relative helping a parent each change who may give notice and whether the consumer liability regime reaches the account at all. Ask whose account it is, and if it is a company account or the user is not the holder, say the position may differ and route them to the bank and a lawyer rather than guessing.
Do not cite the Debit Cards Law. It is repealed outright by s.55 of the Payment Services Law. Its numbers survive in circulation and look right, which is exactly why the citation slips through. The live provisions are ss.24 and 27 of the 2019 law. Quoting the dead statute to a bank forfeits the user's credibility at the moment they need it.
Do not repeat "the bank has 30 days". That was the repealed regime. It is 8 business days, and repeating the old figure hands the bank three weeks the user is entitled to.
Do not tell the user to go to the police first. It feels responsible and it is wrong: no clock in the statute is triggered by a police report, while the ₪30 per day clock keeps running.
Do not repeat "check the sender name", even though official bodies say it. Bituach Leumi's own page lists it, and it is not sufficient on its own; the Ministry of Communications has ruled that an alphabetic sender ID is not a unique identifier. Present the domain check, the personal-area check and the independent callback as the load-bearing tests. Do not describe Bituach Leumi as wrong; its other rules are sound.
Never say a message is safe. The skill has no way to verify one. When it cannot confirm, it must still give the action: do not click, and verify through a channel you opened yourself.
Do not state that Israel Post never sends SMS. Customs-payment notifications are a genuine Post service. The overstatement is dangerous because it teaches users to distrust a real message and to trust the next forgery that mimics a denial.
Keep the attributions apart. The SMS-in-genuine-thread warnings come from the National Cyber Directorate's official Telegram channel and have no gov.il permalink; say so. Deepfake warnings about Israeli finance figures come from the National Cyber Directorate, not from the Israel Securities Authority.
Never tell a user to pay whoever took their account. Paying an account hijacker or a sextortion demand buys nothing and marks the user for repeat targeting. For a hijacked WhatsApp the documented route is self-service re-verification, then reporting to WhatsApp, and it never involves payment. See references/reporting-routes.md.
Do not answer the deceived-OTP question. Section 24(ד) is untested on that point. State the text, state the uncertainty, give the action.

Recommended MCP Servers

MCP	Why it helps here
`kolzchut`	Kol Zchut is Israel's authoritative rights and entitlements knowledge base. Use it to pull the current consumer-rights and banking-complaint procedures, and the routes for identity-theft aftermath, rather than relying on memory.

Do not reach for a bank-scraping MCP here. A user who has just been defrauded should not be wiring new access to their accounts, and this skill never needs to read their transactions.

Reference Links

Source	URL	What to check
Payment Services Law, 5779-2019	https://www.nevo.co.il/law_html/law01/502_043.htm	ss.24, 26, 27, 34 to 37, 51, 55. The liability ladder, the 8-business-day refund, the 15-day re-debit warning, the repeal
Proper Banking Management Instruction 426	https://www.boi.org.il/media/k23b3lzq/h2834.pdf	s.3(א) addressee and s.3(ב) repealed, s.4 age 70, s.5(ב) 24/7 human fraud line including Shabbat, six-minute standard, s.7 senior queue priority. Russian-language service is in the explanatory notes only
Bank of Israel, Police, and Ministry of Communications	https://www.boi.org.il/publications/pressreleases/15-4-26a/	The three national fraud patterns, the targeting finding, the porting-message change
Ministry of Communications, hearing decision 03.06.2020	https://www.gov.il/he/pages/03062020_2	Why an alphabetic sender name is not proof of anything
National Cyber Directorate, incident report	https://www.gov.il/he/service/cyber-event-report	119, the reporting form, what the CERT does and does not do
Stop. Disconnect. Verify.	https://www.gov.il/he/pages/us080726	The code word and callback protocol for cloned-voice calls
After the incident	https://www.gov.il/he/pages/fool_me_twice	The aftermath checklist, including new standing orders
Postal Authority	https://doar.israelpost.co.il/content/fishing	The two legitimate Post domains
National Insurance Institute	https://www.btl.gov.il/About/newspapers/Pages/hodaaitonotfakesaagetari2026.aspx	Its own verification rules and the no-credit-card rule
Tax Authority	https://www.gov.il/he/pages/pa010825-1	Current impersonation lures, including the fake investigation notice

Bundled Resources

File	Purpose
`references/domain-checklist.md`	The coverage contract, every source, and the known-wrong advice this skill must never reproduce
`references/russian-phrasebook.md`	What to say on the bank's fraud line, Russian and Hebrew side by side
`references/reporting-routes.md`	Each reporting route, what it achieves and what it will not do, plus the hijacked-WhatsApp path
`scripts/liability_clock.py`	Computes s.24(ג) exposure and shows which limb binds. Branch A only

Troubleshooting

Symptom	Likely cause	What to do
The bank quotes a 30-day refund period	It is applying the repealed Debit Card Law, or the representative is working from old training material	Cite s.27(a) of the Payment Services Law and the eight-business-day period. This is a documented and common error, not necessarily bad faith.
The bank demands a police report before refunding	Internal procedure, not a statutory precondition	A report is useful evidence and a bank may ask for a reference number, but no clock in the statute depends on it. Give notice to the bank first regardless, and say you have done so.
The refund arrived and was then reversed	The bank concluded s.24(ד) or s.26 applies	It owes written reasons at least 15 days before the debit, and copies of its documents on request (s.27(ב)). Request the documents.
Nobody answers the fraud line	Possible breach of Directive 426	Record the time and wait duration. Note s.24(ה) removes liability where no reasonable way to give notice was provided. Complain to the Bank of Israel's public enquiries unit.
The message sits inside a real GOV.IL thread	Not evidence of authenticity	The National Cyber Directorate has documented this. Verify by navigating to the service yourself.
The user asks whether they will get their money back after being tricked into disclosing a code	s.24(ד) is untested on deception	Do not predict the outcome. State the provision, state that it is unresolved, and give the immediate action. Note that s.27(ב) lets the bank re-debit if it concludes 24(ד) applies, so tell them to keep records and use the 15-day window.
The bank says the eight-business-day refund does not apply	The user is probably in branch B, having made the transfer themselves	Check Step 0. If they gave the payment order, the bank is right and the lever is a recall to the beneficiary bank plus a police freeze, not a statutory refund demand.
The account is a joint account, a business account, or the user is not the holder	The consumer liability regime may not reach it, and who may give notice differs	Do not guess. Give notice to the bank immediately regardless, then route to the bank and a lawyer for the position.