You get a phone call about a problem with your bank account.

There’s a pending ACH transfer. A check isn’t going to clear. Suspicious activity has been detected. Whatever the reason, the caller says you need to act now.

You check your phone, and the number looks right. It may even display your bank’s name.

So it must really be your bank calling, right?

Not necessarily.

Scammers can spoof caller ID, making a call appear to come from a legitimate financial institution’s phone number. They may also know your name, where you bank and other personal information that makes the conversation sound convincing.

Bank impersonation scams can target consumers and businesses alike. Knowing how they work—and what to do when something doesn’t seem right—can help you protect your accounts and your money.

How Bank Impersonation Scams Work

These scams often start by creating a problem that sounds urgent.

A caller might tell you:

• An ACH transfer is pending.
• A check won’t clear your account.
• Your account has been compromised.
• An unauthorized transaction needs to be reversed.
• Your money needs to be moved to a “safe” account.
• You need to verify your identity immediately.

Why the urgency?

The less time you have to think, the less likely you may be to stop and question the request.

A scammer may also have real information about you, including your name, phone number, email address, financial institution or other details.

That can make the call sound legitimate.

But knowing something about you doesn’t prove the caller works for your bank.

Bank Impersonation Can Affect Businesses, Too

An impersonation scam doesn’t have to involve someone’s personal checking account.

Businesses can be targeted with requests involving ACH transfers, payroll, vendor payments, checks and other transactions.

A caller posing as a bank employee may tell a business owner or employee that a transaction needs to be stopped or reversed immediately. They may ask for information or direct the employee to take another action to supposedly protect the company’s money.

Whether it’s a personal or business account, don’t let urgency replace your normal verification process.

Caller ID Isn’t Proof of Who’s Calling

Seeing a familiar number can make an unexpected call feel legitimate.

But caller ID can be spoofed.

If someone unexpectedly calls about your account, you don’t need to stay on the line while you figure out whether they’re really from your bank.

Hang up.

Then contact your financial institution yourself using a phone number you already know and trust.

Never Share a Verification Code

Suppose the caller tells you they’re sending a code to your phone.

All you have to do is read it back to confirm your identity.

Don’t.

A one-time verification code may be used to authenticate a login, reset a password or approve another account action.

If you didn’t initiate the request, don’t provide the code to someone else.

You should also keep your online banking username, password and PIN private. A legitimate bank caller will never need those credentials to protect your account.

Don’t Move Money to a “Safe Account”

If someone unexpectedly tells you that you need to move your money to protect it, that’s a major warning sign.

A scammer might refer to a “safe account,” “secure account” or temporary holding account and tell you that transferring your funds is the only way to keep them from being stolen.

Don’t make the transfer.

Instead, independently contact your bank.

The same caution applies if someone tells you to make a new payment to “reverse” a fraudulent transaction. You could actually be sending money directly to the scammer.

Five Things to Do When a Call Doesn’t Feel Right

If you receive an unexpected communication about your bank account:

1. Stop.
   Don’t let someone else’s sense of urgency become yours.
2. Hang up.
   You don’t need to stay on the phone while you decide whether the caller is legitimate.
3. Contact your bank yourself.
   Use the phone number on your debit or credit card, a trusted statement, the bank’s official app or a website address you already know. Don’t use contact information supplied by the person you’re trying to verify.
4. Confirm the situation.
   Ask whether there really is a problem with your account or transaction.
5. Only take action once you know what’s happening.
   Taking a few minutes to verify a request is worth it when your money or information is involved.

If You Think You Fell for a Bank Impersonation Scam

Maybe you shared information before realizing the call was suspicious. Or perhaps you approved or sent a transaction.

Don’t wait.

Contact your bank immediately and explain what happened, including any information you shared.

If money was sent, ask whether the transaction can be stopped, recalled or otherwise recovered. Depending on the payment method, timing and circumstances, recovery may not always be possible.

You should also:

• Change affected passwords from a trusted device.
• Check your accounts for unfamiliar transactions or changes.
• Enable multifactor authentication when available.
• Contact any payment provider involved.
• Keep screenshots, emails, texts, phone numbers and transaction records.
• Report suspected fraud to the Federal Trade Commission at ReportFraud.ftc.gov.
• Consider reporting significant internet-enabled fraud to the FBI’s Internet Crime Complaint Center at IC3.gov.

When Something Doesn’t Add Up, Verify

Today’s scammers can be convincing.

A caller might know where you bank. They may have personal information about you. They may reference something that sounds like a real transaction. Their phone number might even appear to be your bank’s number.

You don’t have to determine whether the caller is real while they’re on the phone.

Hang up. Contact your bank directly. Verify the situation before you do anything else.

That extra step can help protect your personal or business accounts—and make sure that when it comes to your money, you’re dealing with someone you can trust.