'Your Bank' Is the Scammer: A 5-Step Defense Playbook

Analysis — Bank-impersonation scams used fake “new payment set up” alerts to help push imposter fraud to a record $3.5 billion last year. The script is a text that looks like your bank, then a caller asking for the code on your phone. Stop them with these five rules.

1. Spot the hook: a payment you did not authorize

The scam usually starts with a text saying a new payee has been added, a large transfer is pending, or a Zelle payment needs confirmation. The message is designed to look like the alerts your real bank already sends, often copying the same sender label and format. In 2025, imposter scams generated roughly 1 million reports to the Federal Trade Commission and topped the agency’s fraud categories for the fifth straight year, with losses of about $3.5 billion.

The follow-up call comes within minutes. The caller claims to be from the bank’s fraud department and reads back details — the last four digits of your card, a recent transaction, your ZIP code — that were likely bought from a data broker or scraped from a breach. Those details are theater. They do not prove the caller works for your bank.

Gotcha: Scammers time the call to arrive while the fake alert is still on your lock screen, when your pulse is up and your guard is down.

2. Treat caller ID and texts as evidence of nothing

Caller ID can be spoofed in seconds. A scammer can make a call display as “Chase,” “Wells Fargo,” or any local branch number. Text messages can be sent from alphanumeric sender IDs that match your bank’s name. The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses crossing $20.8 billion. Many of those cases began with a spoofed number that the victim trusted.

Your only safe move is to hang up and call the number on the back of your debit card or on the bank’s official website. Do not use a callback number from the text. Do not use a number the caller offers. If the “urgent” issue is real, your bank will still be there in the three minutes it takes you to dial directly.

Pitfall: Pressing “1” to “confirm or dispute” the charge connects you to the scammer, not your bank.

3. Never give passwords, PINs, or one-time codes — ever

No legitimate bank representative will ask for your full password, your PIN, or the one-time code that was just texted to your phone. Those codes are designed to prove you are holding your device, which is why every major U.S. bank sends them through a separate channel. The moment you read one aloud, the scammer uses it to log in as you or approve a transfer to an account they control.

This rule has no exceptions. Not for a “fraud specialist,” not for a “senior investigator,” and not even if the caller already knows your account number, your mother’s maiden name, or the amount of your last deposit. All of that information can be purchased from data brokers or scraped from previous breaches, so proving identity trivia over the phone proves nothing about who is on the line.

Gotcha: Scammers sometimes ask you to “verify” the code by typing it into your own banking app while they coach you over the phone. That still hands them the key.

4. If you shared anything, freeze first and ask questions later

Speed is the only variable you control. Call your bank’s fraud line immediately and say you believe you were contacted by an imposter and may have shared a code or credential. Ask for an account freeze, a debit-card block, and a password reset. Also change the password on the email address tied to your banking account, because email access is often the next target.

If you paid through a peer-to-peer app such as Zelle, Venmo, or Cash App, report it through that app as well. These transfers are usually instant and irreversible, which is why the scam relies on them. Under Regulation E, your liability for an unauthorized electronic transfer is capped at $50 if you report within two business days of learning of the loss, up to $500 if you report within 60 days, and potentially unlimited after 60 days.

Pitfall: Transfers you authorized yourself — even under false pretenses — fall into a gray zone. Banks often treat fraudulently induced payments as “authorized” because you clicked the button. That is why freezing the account before the next transfer matters more than arguing after the fact.

5. File the reports that create a paper trail

After you freeze the account, report the incident to the FTC at ReportFraud.ftc.gov and to the FBI’s IC3 at ic3.gov. If the scammer has enough of your information to open new accounts, also file at IdentityTheft.gov. These reports rarely recover money on their own, but they trigger investigations, help regulators spot patterns, and give you documentation to show your bank.

Request a written confirmation of any fraud dispute from your bank. By law, the bank must investigate and generally has 10 business days to determine whether an error occurred, though that can stretch to 45 days for new accounts. Keep a log of every call, including the representative’s name, the time, and what you were told. That log is your leverage if the bank later disputes whether you reported in time.

Gotcha: Some banks charge a fee for stop-payment orders or replacement debit cards. Before you open your next account, compare what institutions charge for those protections — fees vary widely and can add salt to the wound. See our guide to checking account fees in 2026 for the current landscape.

The bottom line: what it costs vs. what it saves

Prevention is cheaper than recovery. A budgeting app that flags unusual outflows can catch the second fraudulent transfer while you are still on the phone disputing the first. But no app replaces the hard rule: your bank will never call and ask for the code on your screen, and anyone who does is almost certainly a thief.

Last verified Sept. 4, 2026, against current FTC, CFPB and FBI IC3 guidance.