Bank impersonation scams: when the "fraud department" is the scammer
The most dangerous bank scam does not begin with a sketchy link. It begins with someone pretending to protect you. The caller says they are from your bank's fraud department. They know your name. They may spoof the number on the back of your card. They say suspicious transfers are happening right now and you need to act fast.
The goal is to get you to move money, share a one-time code, approve a push notification, or install remote access software. Once you do, the scammer can drain the account while you think you are stopping fraud.
How the scam usually works
You get a text asking if you authorized a transaction.
You reply "No" or tap a link.
A fake fraud representative calls and says your account is compromised.
They ask you to verify codes, move money to a "safe" account, or read card details.
The money leaves your control, often through Zelle, wire transfer, crypto, or a new payee.
Red flags
They tell you not to hang up or not to call the bank yourself.
They ask for a one-time passcode, debit card PIN, full card number, or online banking password.
They say you must move money to keep it safe. A real bank does not ask you to transfer funds to a "safe account."
They ask you to download AnyDesk, TeamViewer, screen-sharing software, or a security app during the call.
They pressure you to use Zelle, wire transfer, gift cards, or crypto.
What to do instead
Hang up. Do not explain. Do not argue. Call the number printed on your debit card or use the bank's official app. Tell the real bank you received a possible fraud department impersonation call and ask them to check recent activity.
If a text includes a link, do not use it. Open the bank app yourself or type the official website into your browser. If you want a quick second opinion, paste the message into ScamKit's message scanner and any link into the link scanner.
If you shared a code or moved money
Call the real bank immediately and ask for the fraud department.
Say clearly that you were tricked by a bank impersonation scam.
Ask them to freeze online banking, cancel compromised cards, and attempt a transfer recall.
Change your banking password from a clean device.
File reports with the FTC and, for larger losses, the FBI IC3.
Not sure if a bank alert is real?
Paste the alert into ScamKit before you respond. Real fraud alerts do not need your password, PIN, or one-time code.