A stranger can phone you, name a fake $1,200 electronics purchase, and ask whether that charge was yours. Would you stay on the line?
Hang up. Call the number printed on your card.
The FDIC and the FCC both warn that these calls manufacture urgency so you skip the one check that would expose them. Don't debate the "fraud agent" who placed the call.
A caller impersonating a fraud department invents an unauthorized charge or withdrawal. They use the shock to harvest a one-time code, a card CVV, or remote access. Banks almost never open that way.
The FBI tracks account takeover fraud that starts when someone impersonates bank support. Since January 2025, IC3 received more than 5,100 complaints and more than $262 million in reported losses. Don't stay on that cold call. Distrust inbound "fraud alerts" until you verify them yourself.
What these scam calls actually sound like
What you hear first is a story you want to believe, that someone already stole from you and this person is calling to help, which is why the opening minute feels useful instead of dangerous, and a PIN demand is rare at the start.
A typical opener names your bank, a dollar amount, a merchant, and the last four digits of a card. Caller ID may even show the bank. That spoof is cheap.
They wait for you to say you didn't make the charge, and after that the talk shifts to "verification" so they can reverse it. Thing is, the verification is the theft.
The FCC posted an audio example of a fake automated system telling you to press 1 if a transaction wasn't yours.
Don't press 1. They may ask for the CVV, a text code, your Social Security number, or screen-sharing software. Some versions skip card data and push a "safe account" transfer, gift cards, or crypto instead.
I won't reprint a full working script, because scammers don't need more copy and you don't need a transcript to recognize the plot: fake loss, fake helper, then a request no real bank makes on a call they placed.
Hearing your own name doesn't make the caller legitimate. Data breaches leak names, partial account numbers, and old addresses, so a polished opener can still be a stranger.
Scam call versus a real bank
Real banks can call you. They still won't need your CVV, and they won't ask you to read back a one-time passcode from a text they supposedly just sent.
| What you notice | Impersonation scam | Legitimate bank contact |
|---|---|---|
| Who started it | An unsolicited call or text | You reported a problem first, or they tell you to call back on a number you already have |
| The ask | CVV, PIN, SMS code, remote access, gift cards, a "secure" transfer | None of those secrets on an inbound call |
| Pace | Act in minutes or lose the money | Time to hang up and dial the number on your card |
| Proof they offer | Caller ID, a case number, a supervisor | You initiate contact on a known channel |
If a real charge exists, you'll see it in the official app after you hang up. The call isn't evidence.
What to do in the moment
Get off the call before you confirm anything.
- Stop talking. Don't confirm your name, the last four digits, or whether a charge is yours.
- Hang up. Don't press 1. Don't accept a callback number from the caller.
- Use a different phone if you can. Call the number on the back of your debit or credit card, or open the bank's app from your home screen, not from a text link.
- Check recent activity on your own. If nothing looks wrong, ignore that alert.
- If something does look wrong, dispute it inside the app or on that official call. That process isn't the one the inbound caller offered.
- Write down the time, the name they used, and any number on caller ID. Save it for a report. Don't use it to argue with the scammer.
Don't call back a number they recited. Don't return a missed "fraud prevention" call.
If you already gave a code, a card number, or money
Treat the account as compromised. From a device you trust, change the password and ask the bank to freeze or replace the card.
If the bank offers an authenticator app or a hardware key, switch to that so SMS codes are less useful to the next caller.
People underestimate that code, to be honest. If you read a code to the caller, that code may have approved a login or a transfer, and the bank will not magically know you handed it to a stranger unless you call the number on the card the same day and say, plainly, that you gave a live code to someone who claimed to be fraud prevention.
If you sent a wire, used Zelle or another payment app, bought gift cards, or moved crypto, say that immediately, because gift-card and crypto payments are hard to reverse.
The FBI tells people to report fraudulent wires to the bank and to IC3 together. Report them anyway. Use the payment app's fraud button, then call your bank on the printed number.
Don't send more money to unlock or insure the first loss. That second request is the same crime.
When a charge on your statement is actually unauthorized
The inbound call can be fake while a line on your statement is real. Treat those as two different problems. Which rule applies depends on the payment rail.
Debit cards and linked accounts fall under Regulation E. That rule limits what you can be forced to pay if you notify the bank in time.
If you notify the institution within two business days after you learn an access device was lost or stolen, your liability is capped. The cap is the lesser of $50 or the unauthorized transfers that occurred before notice. The cap can rise to $500. That higher cap applies in the situations the rule describes.
A second clock starts when a periodic statement is sent, and you have 60 days after that to report unauthorized transfers shown on the statement. If you wait longer, you can be held responsible for later transfers the bank shows would not have happened if you had given notice.
Credit cards sit under a different statute. For a billing error that includes an unauthorized credit card charge, Regulation Z gives you written billing-error rights, and you generally need to notify the creditor in writing within 60 days after the first statement that showed the error. Investigation timelines aren't the same as Regulation E.
If you were talked into sending the money yourself, the bank may treat that payment as one you authorized, not as a stolen-card event. P2P tools get argued that way. Report the incident anyway. Don't assume the dollar caps above will cover a transfer you confirmed.
This isn't legal advice. Ask the bank which notice method it counts. Send a written follow-up the same day you call.
How to report the impersonation attempt
Report the call even if you lost nothing. Other people will hear the same pitch.
Start at ReportFraud.ftc.gov, then file a cyber complaint through IC3. Tell your bank so it can flag the spoof. If money moved, add a local police report, because some banks ask for a case number.
The FTC found that consumers reported $12.5 billion lost to fraud in 2024. Bank impersonation was already the most reported text-message scam in 2022, up nearly twentyfold since 2019.
Turns out the useful move is boring. Save the customer-service number from your debit and credit cards in your phone under the bank's real name. Next time someone claims a surprise charge, hang up, then dial that saved contact.