Sincerely, this is sad. Before now, there was a misconception that some particular banks are used for fake alerts. But at you've rightly said, no bank is excepted.

As business operators, we should be good cautious. Only release goods upon confirmation.

But I believe it's set time your store purchases a POS machine as well. Or you have a device where you receive notifications as well. These scammers thrive where there are loopholes.

No stone should be left unturned by entrepreneurs. Because this is so disheartening.