Bank impersonation scams: how to spot fake messages from your bank

How the scam works

It usually starts with a text that looks like a fraud alert from your bank: "Did you attempt a $1,250 Zelle payment? Reply YES or NO." If you reply, a "fraud specialist" calls within minutes, sometimes from a number that shows your bank's name. They say your account is compromised and that, to protect your money, you need to send it to yourself or to a "safe account" through Zelle, or read them the code that just arrived by text.

The money goes straight to the scammer. Instant payments like Zelle are designed to arrive in minutes, which is exactly why they are so attractive to criminals.

Read also: How to spot a fake website before you type your password and How to tell if your WhatsApp was hijacked and what to do.

What real banks never ask

• They never ask you to move money to "protect" it, or to send money to yourself.
• They never ask for your password, full card number, PIN or a verification code by phone, text or social media.
• They never ask you to pay with gift cards, crypto or a wire to resolve a problem.

Caller ID can be faked, a technique called spoofing, so the name on the screen proves nothing. The Federal Trade Commission compares sending money through a payment app to handing over cash: once it is gone, it is hard to get back.

Source: Federal Trade Commission, Mobile Payment Apps: How To Avoid a Scam When You Use One.

Signs of a fake message

• Extreme urgency, like "your account will be locked in one hour."
• Links in texts or emails that lead to a login page, often with an address slightly different from the real one.
• A request to act outside the bank's official app, by reply, link or phone.
• Pressure not to hang up or not to tell anyone, including bank branch staff.

When in doubt, hang up and call the number on the back of your card, or open your bank's app yourself. See also how to spot a fake website.

If you fell for it: the first hours

1. Call your bank immediately using the number on your card and report the transfer as fraud. Ask whether it can be stopped or recovered; some banks may reimburse certain impostor scams, but it is not guaranteed.
2. Change your online banking and email passwords and turn on two-factor authentication.
3. Report it at ReportFraud.ftc.gov and, for larger losses, to the FBI's Internet Crime Complaint Center at ic3.gov.
4. If the bank refuses to help, you can submit a complaint to the Consumer Financial Protection Bureau.
5. Keep everything: screenshots, phone numbers, times and transaction confirmations.

Source: Consumer Financial Protection Bureau, Fraud and scams.