A bank impersonation scam can arrive as a convincing call, text, or email. This reusable verification checklist shows how to pause, confirm the message through a trusted channel, and refuse requests for codes, transfers, passwords, or remote access without putting your account at greater risk.
Overview
Bank impersonation scams work by creating urgency and borrowing the appearance of a trusted financial institution. The message may claim that a payment is suspicious, an account is locked, a transfer must be approved, or a security setting needs to be updated. The stated problem can vary, but the requested action is often the important clue: disclose a one-time code, move money, click a link, install software, or provide remote access.
A genuine-looking caller ID, logo, signature, or bank name does not prove that a message is authentic. Contact details can be manipulated, and a scammer may already know basic information about you. Treat an unexpected bank fraud alert as unverified until you confirm it independently.
The safest general rule is simple: do not use the contact details or links supplied in the alert to investigate the alert. Instead, end the interaction and contact the bank through a method you already trust, such as the number printed on your card, a statement, or the bank's official app or website that you open separately.
Checklist by scenario
Use the first few steps in every case: stop, do not reply, do not click, and do not share information. Then apply the channel-specific checks below.
| Channel | Common warning signs | Safe verification approach |
|---|---|---|
| Phone call | Pressure to act immediately, demands for a one-time code, instructions to move funds, or a request to install remote-access software. | Say you will call back using the number on your card or in the official banking app. Hang up first; do not let the caller transfer you or provide the callback number. |
| Text message | A shortened link, unfamiliar sender, alarm about a transaction, or a request to reply with personal information or a verification code. | Do not tap the link or reply. Open the official banking app yourself, or type the bank's known web address manually, and check for an account notification. |
| An unexpected attachment, mismatched sender domain, urgent warning, unusual formatting, or a button leading to a login page. | Do not use the email's buttons, phone numbers, or reply address. Contact the bank independently and report the message through the bank's established reporting process if available. | |
| Social media or messaging app | A supposed bank representative offers help through a private message, asks for account details, or directs you to a separate support account. | Do not continue the conversation. Use the bank's official support page or app, and verify that any account you contact is one you reached independently. |
Callback verification checklist
- End the original call or stop responding to the message.
- Find the bank's contact information from a physical card, a prior statement, or the official app you access directly.
- Call or message through that trusted route, not through a link or number in the alert.
- Ask whether the claimed alert, transaction, or account restriction is recorded on your account.
- Ask what action is required, if any, and complete it only inside the official banking channel.
- Record the time, channel, sender details, and what the suspicious contact requested. This can help the bank investigate.
Scripts for refusing risky requests
You do not need to debate with a caller or prove that you understand the risk. A short response is enough:
- For a verification code: “I do not share security codes. I will contact the bank using its official number.”
- For a transfer: “I will not move money at your direction. I will verify this independently.”
- For remote access: “I do not install software or allow remote access during an unsolicited support call.”
- For a link: “I will open the bank's app myself rather than use a link in a message.”
What to double-check
Look for several clues together rather than relying on one visual detail. Check the complete sender address, not only the display name. In an email, hover over links without opening them and look for a destination that does not match the bank's known domain. Be cautious with lookalike spellings, extra words, unusual subdomains, URL shorteners, and unexpected attachments.
For text messages, remember that a familiar-looking sender name or thread does not establish authenticity. For calls, caller ID is not a reliable identity check by itself. A scammer may also know your name, partial account information, or recent activity. That information can make a fake bank call sound credible, but it does not authorize the caller to request a password, one-time code, or transfer.
Pay special attention to the action being requested. A security code is intended to confirm an action you initiated, not to be read aloud to someone who contacted you. A legitimate bank process may require authentication, but you should complete it through a trusted banking session rather than disclose credentials to an unsolicited contact. When uncertain, ask the bank to explain the alert without taking action during the original interaction.
If you already clicked a link, entered credentials, shared a code, installed software, or approved a transaction, act quickly. Contact the bank through its trusted channel, explain exactly what happened, and ask what account-protection steps are appropriate. Change affected passwords from a clean device or trusted session, review recent activity, and preserve the message and related details. For a broader response sequence, see What to Do After a Data Breach and the account takeover warning signs checklist.
Common mistakes
- Calling the number in the message: This reconnects you to the same unverified source. Find the number independently.
- Clicking first to inspect the page: A page can be designed to capture credentials even if you do not finish signing in. Open the official app or site yourself.
- Trusting caller ID or branding: Presentation is not verification. Confirm through a separate channel.
- Reading out a one-time code: A code can authorize an action. Never share it with an unsolicited caller or reply.
- Continuing because the caller knows personal details: Treat known information as unverified context, not proof of identity.
- Moving money to “protect” it: Do not transfer funds to a new account because a caller says it is safer. Verify the situation with the bank first.
- Deleting evidence immediately: Keep the email, text, number, URL, and timestamps until the bank or another reporting channel no longer needs them.
For a wider process covering suspicious emails, texts, websites, and calls, use the “Is This a Scam?” investigation checklist. Technology and security teams can also adapt the same pause-and-verify method to internal security alert triage.
When to revisit
Keep this checklist available before seasonal planning cycles, periods of heavy travel or shopping, and any time your bank changes its app, login process, fraud-notification settings, or support contacts. Review it when a household member joins a shared account, when an employee receives authority over company finances, or when your organization changes its payment workflow.
Businesses should turn the guidance into a short internal procedure: define the approved callback methods, require independent confirmation for payment changes, and give staff a script for refusing codes and remote access. Review the procedure whenever tools or workflows change. A small business can also use the security alert monitoring workflow guide to formalize escalation and recordkeeping.
When the next bank fraud alert arrives, do not decide under pressure. Stop the interaction, preserve the evidence, and verify through a trusted route. If you already responded, contact the bank immediately and describe every action taken. That sequence remains useful even as scam messages, phone numbers, and delivery methods change.
