How to Recognize a Bank Impersonation Scam
Your bank is one of the few institutions that can plausibly text, call, or email you at any hour, which is exactly why scammers impersonate it so often. This guide is for anyone who's ever received a "suspicious charge" alert and felt their stomach drop. We'll show you how bank and payment-app impersonation works across every channel, why the "did you make this charge?" trick is so effective, and the single rule that defeats nearly all of it.
How we check this: Reflects how the FTC, CFPB, and major banks describe impersonation and payment-app fraud. · Last reviewed: 2026-08
One scam, three channels
Bank impersonation isn't a single scam. It's the same lie delivered by text, phone, or email, often in combination. A text says there's an unusual charge. A minute later a call comes in from what looks like your bank's number. An email lands to "confirm" everything. Each channel makes the others seem more real, and that reinforcement is the whole point.
The impersonation can be your bank, your card issuer, or a payment app like a peer-to-peer transfer service. The story is always framed as protection: someone tried to move your money, and the caller is here to help you stop them. That framing lowers your guard, because you feel like you're on the same team as the person contacting you.
It helps to remember what your real bank already knows and already does. It knows your name and account details, so it won't ask you to "confirm" them from scratch. It can freeze a card or block a payment on its own, so it doesn't need you to authorize anything urgently to keep you safe. And it will happily wait while you hang up and call back, because a real bank has nothing to lose from your caution, while a scammer has everything to lose from it.
If you want the full playbook on spotting fake messages that claim to come from a bank or official body, our official-messages hub pulls the signals together in one place.
The "did you make this charge?" trick
The most common opener is a text or call asking you to confirm a transaction: "Did you attempt to send $850 to an unknown recipient? Reply YES or NO." You reply NO, which is true, you didn't, and now you've engaged. A moment later, a caller "from the fraud department" walks you through "reversing" the charge, which somehow requires you to read back a code, move money to a "safe account," or confirm your login.
That's the sleight of hand. There is no charge. Your NO simply confirmed you're a live, worried person, and the rest of the call is theater designed to get you to authorize a transfer or hand over a credential. Real fraud departments block a suspicious charge and let you sort it out. They don't ask you to move money to protect it.
The payment-app version works the same way: a fake alert asks whether you sent money on Zelle or a similar service, and the "agent" who calls you next uses your denial to talk you into sending a real payment to "cancel" the fake one. The direction of money is always the tell.
Why the caller ID and the code feel convincing
Two details make these calls hard to shake off. The first is spoofing: scammers can make your phone display your bank's real name or number, so "it came up as my bank" proves nothing about who's actually calling. The second is the verification code. The caller says the bank is texting you a code to "confirm your identity" and asks you to read it back. That code isn't confirming anything for them. It's the code that lets them into your account or authorizes their transaction.
No legitimate bank employee will ever ask you to read back a one-time code, PIN, or full password. If someone on a call asks for a code that just arrived by text, the call is a scam, no matter what the screen says. Hang up.
The same logic applies to the caller telling you not to hang up, or to keep the call going while you go to your branch or ATM. Pressure to stay on the line is a control tactic, not a security measure. A genuine bank interaction can always be paused and resumed; a scam depends on never letting you off the phone long enough to think or to call someone who'd talk you down.
Emails work the same way with different props. A fake bank email leans on an urgent subject line, a login button that leads to a lookalike domain, and just enough real branding to pass a glance. The safest move with any bank email is never to click the button, open a new tab and type in the address yourself, or use your app. If the message is real, you'll see the same alert waiting for you inside your account.
The one rule that beats it: call the number on your card
Here's the habit that neutralizes almost every version of this scam. If you get any message or call about your account, don't use the number, link, or callback in that message. Hang up or set it aside, turn over your card or open your official banking app, and contact the number printed there. You'll reach the real bank, and you can ask them directly whether anything is wrong.
This works because the entire scam depends on keeping you inside a channel the scammer controls. The moment you leave it and reach the bank on your own terms, their story collapses. There was no charge, no fraud department calling, nothing to reverse. It costs you two minutes and defeats a spoofed number, a convincing script, and a fake email all at once.
Build the reflex now, before you're the flustered person on the call. Any unexpected contact about your money gets the same response: I'll call the number on my card and check.
Smishing, imposters, and what to watch for
Bank impersonation by text has its own name, smishing, and it leans on links to fake login pages. If a bank text contains a link asking you to sign in or verify, don't tap it; log in the way you normally do instead. The broader category is imposter scams, where someone claims an authority they don't have to get you to act against your own interest.
Watch for the recurring signs: urgency ("act now or your account will be frozen"), a request for a code or password, pressure to move money, and any push away from your bank's official channels. Any one of these should stop you; two together mean it's a scam.
If a message about your account also touches shopping, deliveries, or a suspicious login on another service, our sibling guides on scam texts and phishing emails cover those angles in more depth.
FAQ
My bank texted about a suspicious charge, is it real?
It might be, but don't respond to the message or call any number it gives you. Instead, call the number on the back of your card or open your official banking app and ask. If there's a real issue, the bank will confirm it through their own channel.
Will my bank ever ask me for a verification code over the phone?
No. A one-time code, PIN, or password is for you alone. Anyone who calls and asks you to read back a code that just arrived by text is trying to get into your account, even if the caller ID shows your bank's name.
The caller ID showed my bank's real number. Doesn't that prove it's them?
No. Caller ID can be spoofed to display any name or number, including your bank's. Never treat the number on your screen as proof of who's calling, hang up and dial the bank yourself.
Why would a scammer ask me to move money to a "safe account"?
Because that "safe account" is theirs. Legitimate banks freeze a suspicious charge and investigate. They don’t ask you to move your own money to protect it. Any instruction to move funds is a scam.