Bank Impersonation Scams: What to Do When "Your Bank" Calls

Article summary: A caller claiming to be from your bank’s fraud department says your account has been compromised and needs to be verified right now. That single word, "now," is doing all the work in a bank impersonation scam. Hanging up and calling the number on the back of your card, rather than reacting to the pressure, is the one habit that stops nearly every version of this scam.

The phone rings, and the caller ID shows the name of your bank. The person on the other end says there’s been suspicious activity on your account, and they need to verify a few details before they can secure it.

At first, everything seems legitimate. They know the last four digits of your card. They may even know which branch you use. Then they ask you to read back a verification code that was just sent to your phone.

That’s where it pays to stop and take a closer look.

Bank impersonation scams are designed to feel convincing, especially when the caller already has some of your information. But knowing how a legitimate bank communicates with customers, and taking a moment to verify who you’re actually dealing with, can help you spot a scam before you hand over access to your account.

Why "Urgent" Is the First Red Flag

The caller may claim that money is being transferred, someone is trying to access your account, or your card needs to be locked immediately.

That sense of urgency is intentional. A legitimate bank may contact you about suspicious activity, but you should not feel pressured to provide sensitive information or make an immediate decision during an unexpected call. 

Scammers also have more information to work with than many people realize. A familiar-looking caller ID combined with a few real details obtained through a data breach, phishing attempt, or other source can make a fraudulent call sound surprisingly convincing.

How Bank Impersonation Scams Actually Work

These scams usually follow one of three scripts, sometimes combined in the same call or message.

The caller who already knows your information

Scammers can get personal information exposed in previous data breaches, including names, phone numbers, and partial account or card numbers. When a caller can repeat those details back to you, it can make the conversation feel much more legitimate.

The link that looks like your bank’ login page

A text or email may claim there’s a problem with your account and ask you to click a link to verify your information. The page may look almost identical to your bank’s real login screen, but anything you enter is sent directly to the scammer.

The request for a "security code" 

This is where the scam can turn into account access. The scammer may initiate a real password reset, login attempt, or transaction, causing the bank to send a one-time security code to your phone.

If you read that code to the caller because you think you’re confirming your identity, you may actually be giving the scammer what they need to get into your account.

Why This Scam Keeps Working

Bank impersonation scams work because they borrow the trust of a real institution and combine it with a problem that feels like it needs an immediate response.

The threat is growing, too. CrowdStrike reported that voice phishing, or vishing, attacks increased 442% between the first and second half of 2024. Its research also found that criminals are using generative AI to improve social engineering and make attacks easier to create and scale.

The Federal Trade Commission offers two simple warnings: never give a caller a verification code, and never move money because someone says it needs to be “protected.” A legitimate bank fraud department will not ask you to do either.

The FDIC also warns that scammers create convincing fake bank websites and may misuse the FDIC’s name or logo to appear legitimate. 

What to Do If "Your Bank" Contacts You

Hang up or stop replying. There's no requirement to stay on the line or keep answering questions from an unverified caller.

Call the number on the back of your card or your bank’s official website, never one provided by the caller. This lets you verify the situation directly with your bank.

Never share a one-time code, PIN, or password with anyone who calls or texts asking for it. According to the American Bankers Association, a real bank will never ask a customer for that information over the phone, in a text, or by email.

Watch for the same red flags that show up in phishing emails, since bank impersonation scams frequently start as a text or email before moving to a phone call. The pressure tactics are nearly identical either way.

Report the attempt to your actual bank and to the FTC, even if no money or information changed hands. Reports help flag the phone numbers and accounts scammers are actively using.

If your team handles wire transfers or account changes for the business, build the same verification habit into that process that protects logins elsewhere. A request that arrives suddenly and demands immediate action deserves a callback before it deserves a response.

Ready to Build a Verification Habit Your Team Will Use?

Bank impersonation scams depend on catching someone off guard. A simple verification process can make it much harder for a convincing call, text, or email to turn into a costly mistake.

For businesses, that means making sure employees know exactly what to do when a financial request seems suspicious and who to contact before taking action.

BrainStomp can help you build practical security processes that protect your business and give your team clear steps to follow. Contact BrainStomp or call 260-918-3548 to get started.

Article FAQs

How do I know if a call from my bank is legitimate?

If you’re unsure, hang up and contact your bank using the number on the back of your card or its official website. This lets you verify the call without relying on information provided by the caller.

Will my bank ever ask for a one-time verification code?

Banks use one-time codes to confirm logins, transactions, and other account activity. Never share a code with someone who unexpectedly calls or messages you asking for it. Instead, contact your bank directly if you’re unsure why you received one.

Can a scammer's phone number really show up as my bank's real number?

Yes. Caller ID spoofing can make a fraudulent call appear to come from your bank or another trusted organization. Even if the name or number looks familiar, caller ID alone is not proof that the call is legitimate.