Bank Impersonation Scams

In a bank impersonation scam, someone claiming to be your bank's fraud department tells you your account has been compromised and that you must act immediately to protect your money. The instruction that follows is always some version of the same thing: move your funds to a "safe account" they will provide. That account belongs to the scammer. Impersonation is the largest single category of fraud reported to the FTC, and it has held that position for nine consecutive years.

How It Works:

• The Warning: A text or call arrives about a suspicious charge. If you reply or call the number provided, you reach the scammer's "fraud department," complete with hold music and a case number.
• The Credibility Build: They already know things. Your name, the last four digits of your card, maybe a recent real transaction bought from a data breach. Caller ID shows your bank's actual number, because spoofing it is trivial.
• The Code Request: They send a genuine verification code to your phone and ask you to read it back "to confirm your identity." The code was triggered by them logging into your account, and reading it out hands them the keys.
• The Transfer: If they cannot get in themselves, they get you to do it. You are walked through sending your balance by Zelle, wire, or crypto to an account they describe as being in your own name, held safely while the "investigation" runs.

Why This One Is So Costly:

Because you authorize the payment yourself, the protections that cover a stolen card do not apply. Zelle and similar peer-to-peer transfers settle within seconds and are effectively irreversible, and banks generally treat an authorized push payment as your decision rather than a fraudulent charge. Recovery is possible but far from guaranteed, which is why prevention matters more here than almost anywhere else.

Key Red Flags:

• Any request to move money to a "safe," "protected," or "secure" account. No bank has ever done this. It is the single clearest tell in all of consumer fraud.
• A request to read back, type in, or forward a one-time passcode. Real staff never need your code.
• Being asked for your full password, PIN, or online banking login.
• Pressure to stay on the line, act now, or keep the matter to yourself.
• Being asked to install remote access or "bank security" software.
• Instructions to withdraw cash for collection by a courier, or to feed cash into a crypto ATM.

How to Protect Yourself:

• Hang up and call the number on your card: Not the number that called you, and not one from a text or a search result. Use a different phone if you can, or wait a couple of minutes before dialing, since scammers can hold the line open.
• Treat every code request as an attack: There is no legitimate situation in which someone needs your one-time passcode. None.
• Slow the call down deliberately: Tell them you will call back. A genuine fraud department will have no problem with that. A scammer will escalate, and that escalation is your answer.
• Use the in-app alerts: If there is a real problem with your account, it will be visible when you open your banking app yourself.
• Talk to someone before you transfer: A single sentence to a friend or family member has stopped a great many of these.

These calls often begin as a scam text or a QR code. If you were persuaded to receive and forward money for someone else rather than send your own, see Money Mule Schemes.