Bank Impersonation Scams: How To Spot and Avoid Them

Bank impersonation scams are a type of fraud in which criminals pretend to represent your bank so they can steal your money or sensitive information — but note that a real bank would never ask you to share a verification code, install remote-access software or move your money to a "safe account."

Scammers can make your bank's real phone number appear on caller ID and pressure you to act before you have time to verify the contact. Here are the red flags to watch for and the exact steps to take if you suspect a scam.

Key Takeaways

• Bank impersonation scams are surging. The FTC found these were the most-reported scam sent by text in 2022, up nearly twentyfold since 2019, and a typical victim lost about $3,000.

• Caller ID can lie. Scammers use spoofing to show your bank's real name and number, and under the Truth in Caller ID Act, spoofing to defraud can carry penalties of up to $10,000 per violation.

• A real bank will never ask for certain things. No legitimate bank employee will ask you to read back a verification code, move money to a "safe account," send funds through Zelle or Venmo, or install remote-access software.

• Hang up and call the number on your card. If a call, text or email feels off, disconnect and reach your bank using the number on your card or statement — never a number the caller or message gave you.

• Report fast to protect your money and your options. Tell your bank right away, then file a report at reportfraud.ftc.gov; under Regulation E, you generally have 60 days after your statement is sent to report an unauthorized transfer.

• Some losses may be recoverable, but it depends. If a scammer moves your money using information you shared, that can count as an unauthorized transfer with federal liability protections — but money you send yourself is often treated differently, so report it immediately.

Summary generated by AI, verified by MoneyLion editors

MoneyLion offers a service to help you find personal loan offers. Based on the information you provide, you can get matched with offers for up to $100,000 from our top providers. You can compare rates, terms and fees from different lenders and choose the best offer for you.

How Bank Impersonation Scams Work

Bank impersonation scams usually start with an unexpected call, text or email about possible fraud on your account. The message may mention a specific purchase or use your name to make the contact seem legitimate. If you respond, the scammer may ask for information that gives them access to your account or tell you to move your money.

• Phone spoofing: Scammers can falsify caller ID so the call displays your bank's name or real customer-service number.

• Fake fraud alerts: A text or email may ask whether you recognize a purchase, then connect you with someone posing as a bank employee when you respond.

• Urgency and scare tactics: The caller may warn that your account will be locked or that more transactions will go through unless you act immediately.

• Fake bank websites: A link may open a copy of your bank's website that records the username, password or account information you enter.

• Credential requests: The caller may ask for your PIN or password, or try to trigger a one-time code and ask you to read it back so they can complete their own login attempt.

• Remote-access requests: Some scammers claim they need legitimate tools like AnyDesk, TeamViewer or QuickSupport to investigate the fraud, but the app can let them view or control your device.

• Safe account transfers: You may be told to move money to another account for protection, even though the scammer controls it.

How To Tell if a Call From Your Bank Is Real

Banks sometimes call customers about suspicious activity, but a legitimate bank caller will not ask for your password, PIN, remote access to your device or a transfer to "protect" your money.

A scam call can feel real because the caller may already know your name, account number or a recent transaction from a previous data leak or phishing attempt, not from anything your bank told them.

If anything about the call feels off, hang up and call the number printed on your card or statement.

Red Flags That Signal a Scam

Watch for these signs when someone claiming to be from your bank contacts you.

• The contact was unexpected. Banks do send fraud alerts, but a call, text or email that shows up out of nowhere and immediately pushes you to act deserves to be treated with caution.

• The situation is framed as urgent. Threats of fraud, legal action or financial penalties are meant to rush your decision before you can verify.

• The caller will not let you disconnect. You may be told to stay on the line, avoid calling back or skip visiting a branch.

• The caller tells you to distrust your bank or keep the call secret. Scammers may claim a branch employee is involved in fraud and ask you not to mention the call to family or staff.

• The caller wants your password, PIN or a one-time code. No legitimate bank employee needs this information read aloud to fix a problem over the phone, since they already have secure ways to verify you without it.

• The request involves installing software or moving your money. A bank will not need remote control of your device or a transfer to a "safe" or "new" account to correct fraud.

One unusual sign does not automatically mean a call is fraudulent. If two or more of these warning signs appear, hang up.

What To Do if You Suspect a Scam

1. Hang up if it's a call, stop responding if it's a text or email, and don't click any links they sent. Don't call back on any number the caller or message gave you, even if it looks legitimate.

2. Call your bank yourself using the number on your card or a recent statement, not anything from the suspicious call or text. Ask whether they actually tried to reach you.

3. If money's already gone, tell your bank immediately rather than waiting to gather more details first. Faster reporting improves your odds of getting it back.

4. If you gave someone remote access to your device, disconnect it from the internet and remove the remote-access software first. Then change your online banking password through the bank's official app or website, ideally from a different device, and update it anywhere else you reuse that password.

5. Report the incident to your bank's fraud department, including the number that called, any screenshots and roughly when it happened. Then file a report with the FTC at reportfraud.ftc.gov so they can track the scam pattern.

Keep an eye on your account for a few weeks after. Scammers sometimes wait before trying anything with what they got.

FAQ

Can a scammer really make it look like my bank's calling me?

Yes. Scammers use spoofing services to display your bank's real name and number when they call, even though it's not actually your bank calling. Spoofing services are cheap and potentially even cost-free, and some take nothing more than downloading an app. 

What should I do if I already gave out my information?

If you already shared information, turn on two-factor authentication and contact your bank to flag the exposure and ask about freezing your card or account. If you shared your Social Security number, place a credit freeze with the major credit bureaus to block anyone from opening new accounts in your name.

Will my bank refund money lost to a scam?

It depends on how the money left your account. If a scammer used information you shared to move the funds themselves, this may be an unauthorized transfer under federal law if the scammer used stolen information about you — so you may have liability protections. Report it as soon as you notice, since timing affects the outcome.

How can I tell a scam text from a real bank alert?

If a text has a link, a phone number to call or a request for account details, don't use any of it. Open your bank's app, go to their website by typing it in yourself or call the number on your card and check from there whether the alert is real.

Key Terms

• Bank impersonation scam: A fraud in which criminals pose as your bank by phone, text or email to trick you into sharing personal information or moving money.

• Caller ID spoofing: Deliberately falsifying the information shown on your caller ID to disguise the caller's identity or impersonate a trusted source like your bank.

• Vishing: Voice phishing — scam calls meant to pressure you into revealing account details or sending money, often outside normal business hours.

• Smishing: Phishing carried out through text messages, often disguised as a bank security alert about a purchase you didn't make.

• Verification code (one-time code): A short code sent during login as a form of two-factor authentication; anyone who asks you to read it back is a scammer.

• Remote-access software: Tools like AnyDesk, TeamViewer or QuickSupport that let another person view or control your device — a real bank will never ask you to install them.

• Unauthorized electronic fund transfer (EFT): Under Regulation E, a transfer from your account initiated by someone else without authority, including transfers made after a fraudster obtains your account information through deception.

Sources

• FTC — Never move your money to "protect it." That's a scam.

• FTC — What's a verification code and why would someone ask me for it?

• FDIC — Bank Impersonation Scams and Fake Banks.

• FCC — Caller ID Spoofing.

• CFPB — Electronic Fund Transfers FAQs.

Summary generated by AI, verified by MoneyLion editors

Photo credit: Pekic/iStock/Getty Images