Loading
Bank impersonation scams are on the rise. Criminals may call, text, or email pretending to be your financial institution and use spoofing technology to make their communications appear like they are coming from your bank! Their goal is often to steal personal information, online banking credentials, or one-time passcodes (OTPs). Knowing the warning signs can help protect your accounts and your finances.
What Is Spoofing?
Spoofing is a tactic scammers use to disguise their phone number, email address or text message so it appears to come from a trusted source.
For example, your caller ID may display your bank's phone number, or a text message may appear in the same conversation thread as legitimate messages you've previously received from your financial institution. While the communication looks legitimate, it may actually come from a criminal.
Because spoofed messages appear trustworthy, they're often used alongside phishing and smishing scams.
What are Phishing, and Smishing?
Phishing
A fraudulent email designed to trick you into revealing sensitive information or selecting a harmful link.
Smishing
A phishing attempt sent by text message.
Scammers often combine tactics for a successful scam. For example, a spoofed text message may include a phishing link that leads to a fake login page.
How These Scams Work
Many bank impersonation scams follow a similar pattern:
- You receive a call, text or email that appears to come from your bank.
- The sender claims there is suspicious activity on your account.
- They create a sense of urgency and encourage immediate action.
- They ask you to provide personal information, login credentials or a one-time passcode.
- The information is used to access your accounts or commit fraud.
Common Example
You receive a phone call that appears to come from your bank. The caller claims someone is attempting to access your account and says a verification code will be sent to your phone.
Moments later, you receive a legitimate one-time passcode from the bank.
The caller then asks you to read the code back to them.
This is a scam.
That code is intended only for you. By providing it, you may unintentionally give a fraudster access to your account.
Common Warning Signs
Be suspicious if someone:
- Asks you to read back a verification code sent to your device.
- Requests your online banking username, password or other login details.
- Uses urgency to push you into acting before you can verify the request.
- Claims your account will be locked unless you respond.
- Directs you to click a link in an unexpected text or email.
- Requests that you transfer money to "protect" your account.
- Refuses to let you hang up and call the bank directly.
How to Protect Yourself
Never:
- Give out codes meant to confirm your identity or approve a login.
- Provide your online banking password or security answers.
- Provide debit card PINs or CVV number from the back of a payment card.
- Use links from unexpected messages to access your account.
- Send money in response to an unexpected request.
Always:
- Pause and confirm unexpected calls, texts or emails before responding.
- Call your bank using a phone number from its official website, app or the back of your card.
- Log in through your banking app or by typing the website address directly into your browser.
- Monitor your accounts regularly.
- Report suspicious activity immediately.
What to Do If You Receive a Suspicious Call, Text, or Email
- Stop communicating with the sender.
- Do not click links or download attachments.
- Do not provide personal information.
- Contact your bank directly using a trusted phone number.
- Report the suspicious communication.
- Monitor your accounts for unauthorized activity.
If you accidentally shared sensitive information or a verification code, contact your financial institution right away.
Below are answers to common questions about bank impersonation scams and spoofed communications.
Bank Impersonation FAQs
What is a bank impersonation scam?
A bank impersonation scam occurs when a fraudster pretends to be a financial institution to steal personal information, account credentials, verification codes or money.
What is caller ID spoofing?
Caller ID spoofing is a technique that allows scammers to make a phone call appear as though it is coming from a trusted source, even when it is not.
Will my bank ask for my one-time passcode?
No. A bank will NEVER ask for your code. One-time passcodes are designed to protect your accounts and should stay private. If someone asks you to share a code sent to your device, treat it as a red flag.
How can I tell if a text message from my bank is real?
Be cautious of unexpected messages, urgent requests or links asking you to verify information. If you're unsure, contact your bank directly using a trusted phone number.
What should I do if I clicked a suspicious link?
Contact your financial institution immediately, change affected passwords, review account activity and report any suspicious transactions.
What is the difference between phishing and spoofing?
Spoofing makes a message appear to come from a trusted source. Phishing uses deceptive messages to trick people into revealing information or clicking on malicious links. Scammers often use both tactics together.
Stay Alert, Stay Protected
Scammers continue to find new ways to impersonate trusted organizations, and technology makes these scams increasingly convincing. Remember that a familiar phone number, text message or email address does not guarantee a message is legitimate.
When in doubt, pause before responding, verify the request and contact your bank through a trusted channel.
Most importantly: Keep passcodes, passwords and sensitive account information private, even if a call, text or email appears to come from your bank.
