Receiving a call or email that appears to come from your bank can be unsettling. The message may warn that someone accessed your account, a payment needs urgent approval, or your card must be replaced. These impersonation scams are designed to make you react before you have time to check what is happening.
How do bank impersonation scams work?
Bank impersonation scams use a familiar name to create trust. The criminal may claim to be calling from your bank’s fraud team, send an email using a convincing logo, or imitate the language used in official correspondence. They may even send an SMS text message to get your attention.
The scam usually starts with a believable problem. You may be told that a suspicious payment has been detected or that your account is at risk. The criminal then tries to guide you toward an action, such as reading out a security code, clicking a link, moving money, or confirming personal details.
These scams often rely on authority, urgency and emotion. A message that creates panic can make people overlook small warning signs that indicate a potential threat.
What information do criminals want?
A scammer may gradually collect details rather than ask for everything at once. They could begin with your name, address or date of birth, then ask for information that appears to confirm your identity as part of a ‘security check’.
The information requested may include:
- Online banking usernames and passwords.
- Card numbers, expiration dates and security codes.
- One-time passcodes sent by text or authentication app.
- Answers to security questions.
- Personal details needed for an identity fraud attempt.
A genuine bank may ask questions during a call you initiated through an official channel. However, you should be suspicious of an unexpected caller who asks for passwords, full card details or one-time authentication codes.
How can a scam lead to account takeover?
An account takeover happens when a criminal gains enough access to control an online account. Often scammers will try to obtain the missing piece of information during a phone call or email exchange.
For example, a scammer may already know your name and bank. They then ask you to read out a one-time code, claiming it is needed to cancel a fraudulent payment. In reality, the code may be approving a new login, password reset or payment set up by the criminal.
Once inside an account, criminals may:
- Change contact details or passwords, locking you out.
- Add a new payee.
- Transfer money.
- Use stored payment information.
- Attempt to access other linked accounts.
Information gathered from several conversations may help criminals apply for services, impersonate you or pass weak identity checks.
What should you do when a bank contacts you?
If you receive a call or message claiming to be from your bank, take moment before responding. A genuine problem with your account can still be checked later, while a rushed decision can give a criminal access to your money or identity.
Use this checklist:
- Stop. Do not click links, open attachments or install software because an unexpected caller tells you to.
- Check the request. Be cautious if you are asked for a password, full card details, a one-time code or a transfer to a “safe” account.
- End the contact. Hang up or leave the email unanswered. Do not rely on caller ID or the address shown in a message.
- Contact your bank directly. Use the number on your card, a paper statement or the bank’s official website. Do not use contact details supplied by the caller or email.
- Review your accounts. Look for unfamiliar payments, new payees, password changes or changes to your contact details.
If you notice any problems or discrepancies, contact your bank and ask for advice on how to report the issue to law enforcement.
What if you already shared information?
Contact your bank immediately if you disclosed banking details, approved a transaction or transferred money. Change any reused passwords, beginning with your email account, and tell your bank that you may have been targeted. Panda’s Random Password Generator makes it simple to create secure codes quickly and easily.
Keep records of the call or message, including the number, email address, links and time of contact. This information may help your bank investigate and support a fraud report.
Treat every unexpected call with caution
When a message claims to be from your bank, slow down and verify it through an independent route. A short pause can prevent a stranger from turning limited personal information into an account takeover or identity theft.
Check out the Panda Security mediacenter to learn more tips and techniques for protecting yourself online.
