How to Recognize Bank Impersonation Scams

Bank impersonation scams are on the rise. Criminals may call, text, or email pretending to be your financial institution and use spoofing technology to make their communications appear like they are coming from your bank! Their goal is often to steal personal information, online banking credentials, or one-time passcodes (OTPs). Knowing the warning signs can help protect your accounts and your finances.

What Is Spoofing?

Spoofing is a tactic scammers use to disguise their phone number, email address or text message so it appears to come from a trusted source.

For example, your caller ID may display your bank's phone number, or a text message may appear in the same conversation thread as legitimate messages you've previously received from your financial institution. While the communication looks legitimate, it may actually come from a criminal.

Because spoofed messages appear trustworthy, they're often used alongside phishing and smishing scams.

What are Phishing, and Smishing?

Phishing

A fraudulent email designed to trick you into revealing sensitive information or selecting a harmful link.

Smishing

A phishing attempt sent by text message.

Scammers often combine tactics for a successful scam. For example, a spoofed text message may include a phishing link that leads to a fake login page.

How These Scams Work

Many bank impersonation scams follow a similar pattern:

1. You receive a call, text or email that appears to come from your bank.
2. The sender claims there is suspicious activity on your account.
3. They create a sense of urgency and encourage immediate action.
4. They ask you to provide personal information, login credentials or a one-time passcode.
5. The information is used to access your accounts or commit fraud.

Common Example

You receive a phone call that appears to come from your bank. The caller claims someone is attempting to access your account and says a verification code will be sent to your phone.

Moments later, you receive a legitimate one-time passcode from the bank.

The caller then asks you to read the code back to them.

This is a scam.

That code is intended only for you. By providing it, you may unintentionally give a fraudster access to your account.

Common Warning Signs

Be suspicious if someone:

• Asks you to read back a verification code sent to your device.
• Requests your online banking username, password or other login details.
• Uses urgency to push you into acting before you can verify the request.
• Claims your account will be locked unless you respond.
• Directs you to click a link in an unexpected text or email.
• Requests that you transfer money to "protect" your account.
• Refuses to let you hang up and call the bank directly.

How to Protect Yourself

Never:

• Give out codes meant to confirm your identity or approve a login.
• Provide your online banking password or security answers.
• Provide debit card PINs or CVV number from the back of a payment card.
• Use links from unexpected messages to access your account.
• Send money in response to an unexpected request.

Always:

• Pause and confirm unexpected calls, texts or emails before responding.
• Call your bank using a phone number from its official website, app or the back of your card.
• Log in through your banking app or by typing the website address directly into your browser.
• Monitor your accounts regularly.
• Report suspicious activity immediately.

What to Do If You Receive a Suspicious Call, Text, or Email

1. Stop communicating with the sender.
2. Do not click links or download attachments.
3. Do not provide personal information.
4. Contact your bank directly using a trusted phone number.
5. Report the suspicious communication.
6. Monitor your accounts for unauthorized activity.

If you accidentally shared sensitive information or a verification code, contact your financial institution right away.

Below are answers to common questions about bank impersonation scams and spoofed communications.