I received a text saying it's from SANTANDER
"We have detected suspicious activity on your account. Please verify via the secure link."
Then it gives a link
Link removed by El Loro for security reasons - it goes to a site in the States using the ChinaGlobal Cache Network ISP.
Saying verify using this link, "to prevent account lockout"