Bank Impersonation Scams: How Spoofed Calls Trick People Into Moving Money

Your phone rings and the caller ID shows your bank’s name. A calm, professional voice says there’s suspicious activity on your account: a large wire, a strange login or a Zelle payment you didn’t make. They already know your name and maybe the last 4 digits of your card. They want to help you stop it, right now.

That call is one of the most expensive scams in the country. According to the FTC, people reported losing $3.5 billion to imposter scams in 2025, and among business impersonators, bank impersonators were tied to the highest reported losses. The scam works because it doesn’t feel like a scam. It feels like your bank protecting you.

This guide explains how caller ID spoofing works, walks through the script scammers use, and shows exactly what to do if you get one of these calls or already sent money.

How caller ID spoofing works

Caller ID was designed to display whatever information the calling network passes along, and for years it was easy to fake. Scammers use internet calling tools to make any name or number appear on your screen, including your bank’s real customer service line.

The Truth in Caller ID Act makes it illegal to send misleading caller ID information with intent to defraud, cause harm or wrongfully obtain anything of value. In 2019, the FCC extended those rules to text messages and to calls that originate outside the US. Spoofing isn’t always illegal, though. A business can legitimately show its main number instead of the line it actually dials from.

To fight malicious spoofing, the FCC required phone carriers to implement a caller ID authentication framework called STIR/SHAKEN in the internet-based parts of their networks by June 30, 2021. It helps carriers flag calls that are likely spoofed. It doesn’t catch everything, and it often can’t tell you who’s actually calling, so a familiar name on the screen still proves nothing.

Key takeaway: The name and number on your caller ID can be faked. Treat any unexpected call about your money as unverified until you hang up and call your bank yourself.

The script scammers use, step by step

These scams follow a surprisingly consistent pattern. The FTC describes the most costly versions as starting with a fake security alert, often appearing to come from a bank, that persuades people to move money to “protect” it.

1. The hook: a fake fraud alert

It often starts with a text asking you to confirm a large transaction, such as “Did you approve a $2,400 transfer? Reply YES or NO.” Reply, and you get a call within minutes from the “fraud department.” Other times it starts with the call itself, or with a pop-up on your computer telling you to call a number.

2. Building trust

The caller knows details about you, often from data breaches or public records. They may read off your address, the last digits of your card or recent purchases. Some send you a text code and ask you to read it back “to verify your identity.” In reality, that code is the one your bank sent to approve a login or a payment the scammer is trying to make.

3. Creating panic

They tell you a criminal, sometimes “a bank employee,” has access to your account. Money is being drained right now. You need to act before the end of the call.

4. The ask: move your own money

This is the turn. They instruct you to:

• Transfer your balance to a new “safe” or “secure” account
• Send yourself money through Zelle or another payment app, which actually sends it to the scammer
• Withdraw cash and hand it to a courier, or deposit it into a Bitcoin ATM
• Buy gift cards or gold
• Install remote access software so they can “secure” your computer

5. Isolation and the hand-off

They warn you not to tell bank tellers, family or anyone else because “the fraud may involve insiders.” Some scams pass you to a second scammer posing as a federal agent. The FTC has warned that scammers posing as its staff tell people to move money, use Bitcoin ATMs or hand cash and gold to couriers. The FTC says it would never ask for these things.

Real bank call or scam? How to tell

Your bank may contact you about fraud. But there are things it will never do.

The single best test: say you’ll hang up and call the number on the back of your card. A real bank employee will agree. A scammer will try to keep you on the line.

Who gets targeted

Anyone with a bank account is a target, but losses skew toward older adults. In an August 2025 data spotlight, the FTC reported that reports from older adults who lost $10,000 or more to impersonation scams had risen more than fourfold since 2020. Combined losses reported by people 60 and over who lost more than $100,000 rose from $55 million in 2020 to $445 million in 2024.

Small business owners are targets too, especially for calls about business accounts, wire transfers and payroll. Our guide to business email compromise covers the email version of this pattern.

Scammers are also using AI to clone voices and write more convincing scripts. Read about AI voice cloning scams and how hackers use AI to see where the tactics are heading.

How to protect yourself and your family

1. Hang up on any unexpected call about your money. Call back using the number on your card, statement or the bank’s official app.
2. Never share one-time codes. A code is permission to log in or move money. No one legitimate needs you to read it out loud.
3. Don’t trust caller ID or text threads. Scam texts can land in the same thread as your bank’s real alerts.
4. Turn on bank alerts for logins, transfers, new payees and large purchases so you see real activity quickly.
5. Use strong sign-in security. Set up two-factor authentication or passkeys on your bank account.
6. Block and filter calls. Use your carrier’s spam filtering and your phone’s call screening. See how to stop spam calls.
7. Agree on a family rule. Anyone who gets an urgent money call talks to a trusted person before acting.
8. Ask your bank about extra safeguards, such as payment limits, a trusted contact on file or a verbal password.

What to do if you already sent money

Speed matters. The sooner you act, the better the chance of stopping or recovering a payment.

1. Call your bank’s fraud line now, using the number on your card. Tell them you were the victim of an impersonation scam, and ask them to stop or recall any pending transfers.
2. Change your online banking password and log out of all devices. If you installed remote access software, uninstall it and have your device checked.
3. Report the payment app or crypto transfer to the app or exchange too.
4. Report the scam to the FTC at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center at ic3.gov.
5. Freeze your credit if you shared personal details like your Social Security number. Our guide on how to freeze your credit takes about 30 minutes.
6. Watch for recovery scams. Anyone who contacts you offering to get your money back for a fee is likely another scammer.

Will your bank refund you?

It depends on how the money moved. The CFPB has said that when a scammer tricks you into sharing your login or a code and then makes an electronic transfer themselves, that transfer is generally treated as unauthorized under Regulation E, which gives you dispute rights. If you sent the payment yourself, even because you were deceived, recovery depends more on the payment type and your bank’s policies, and it’s often harder. Report it in writing anyway, and keep records of every call.

For a full recovery checklist, see what to do if you got scammed.

Where to start today

• Save your bank’s real fraud number in your phone’s contacts from the back of your card.
• Turn on transaction alerts in your banking app.
• Share this rule with your family: “My bank will never ask me to move my money to keep it safe.”
• Set up call filtering with your carrier.

The bottom line

Bank impersonation scams work by making your bank’s name appear on your phone and convincing you to move your own money. The fix is simple and reliable: hang up, call the number on your card, and never move money or share a code because someone called you. Your real bank can wait 5 minutes while you check.

This is general information, not legal advice.

Sources

• FTC: People reported losing $3.5 billion to imposter scams in 2025 (June 2026) — 2025 losses, bank impersonators’ share, fake security alert pattern
• FTC: Four-fold increase in reports of impersonation scammers stealing tens or hundreds of thousands (August 2025) — older adult loss figures, cash, gold and Bitcoin ATM tactics, tips
• FCC: Caller ID Spoofing consumer guide — what spoofing is, legal vs. illegal uses, Truth in Caller ID Act
• FCC Report and Order FCC 20-42 (STIR/SHAKEN mandate) — requirement for voice providers to implement STIR/SHAKEN by June 30, 2021
• CFPB: Electronic Fund Transfers FAQs — fraudulently induced credential sharing and unauthorized transfers under Regulation E