A message that creates urgency should always raise suspicion. A bank never asks for a validation code, a password or a “security” transfer by phone, text or email.
Always check the sender address and type the website address yourself rather than following a received link. When in doubt, hang up and call the number printed on your card.
Turn on strong authentication, use a unique password for your bank and report any unknown transaction immediately.