The Bank Text That Looks Real but Is Not

A Phone Call That Sounds Like Your Bank

The phone rings and caller ID displays a name that matches a well-known
financial institution. A professional voice explains that suspicious
activity has been detected on the account and that immediate
verification is needed. The caller has the account holder’s name, knows
which bank they use, and sounds exactly like the fraud department -
because the entire interaction has been designed to replicate it.

This is bank impersonation fraud, and it is generating losses at a scale
that prompted the FBI’s Internet Crime Complaint Center to issue a
formal public service announcement in November 2025. Since January 2025,
the IC3 has received more than 5,100 complaints specifically about
account takeover fraud carried out through impersonation of financial
institution staff, with total reported losses exceeding 262 million
dollars. The FBI notes that the fraud targets individuals, businesses,
and organizations of all sizes - no particular profile makes someone
more or less likely to encounter it.

Why Caller ID Cannot Be Trusted

One of the most disorienting aspects of these scams is that caller ID
itself can be spoofed. A fraudster calling from anywhere in the world
can make the incoming call display the real name and number of a
legitimate bank. This means the familiar signal that most people rely on
to assess whether a call is real - the displayed name - provides no
reliable information in these schemes.

According to the FBI’s PSA and CPO Magazine’s reporting on the alert,
scammers also impersonate banks through text messages and emails, not
just phone calls. In some cases, the fraud begins not with direct
contact but through what the FBI calls SEO poisoning - paid
advertisements in search results designed to look like the official
website of a financial institution. Someone who searches for their
bank’s customer service number and clicks what appears to be the top
result may reach a convincing counterfeit site built specifically to
capture login credentials.

What Scammers Are After

The goal in bank impersonation fraud is to obtain login credentials,
multi-factor authentication codes, one-time passcodes, or enough
personal information to take over an account and initiate transfers.
According to the FBI, once scammers gain access they typically drain
accounts quickly through wire transfers or cryptocurrency purchases -
transaction types that are difficult to reverse and nearly impossible to
trace once completed.

The FBI PSA describes a specific pattern: the scammer contacts the
account holder claiming a problem requires urgent action, then guides
them through a process that results in sharing the exact credentials or
passcodes needed to access the account. The interaction is designed to
feel like standard bank security procedure. The pressure is steady but
not aggressive. The language mirrors legitimate fraud department
communication.

The Single Rule That Changes Everything

The FBI and FTC both point to one universal protection against this
category of fraud: a legitimate bank will never call, text, or email
asking for a password, multi-factor authentication code, or one-time
passcode. That specific request - regardless of how official the
communication appears - is the clearest possible indicator that the
contact is fraudulent.

If a call or message arrives claiming to be from a bank and asking for
any of those credentials, the appropriate response is to end the
communication immediately and call the bank independently using the
number on the back of the card or on an official statement. Never use a
phone number or link provided in the suspicious communication itself,
since those may route directly back to the scammer. The FBI also
recommends bookmarking bank websites rather than searching for them,
specifically because of the risk of landing on an SEO-poisoned
counterfeit.

If It Has Already Happened

For anyone who believes they have already shared credentials with a
scammer posing as their bank, the FBI’s guidance is to contact the
financial institution immediately and request a recall or reversal of
any unauthorized transactions, along with a Hold Harmless Letter or
Letter of Indemnity. All compromised passwords should be reset
immediately. The incident should be reported to the FBI at ic3.gov and
to the FTC at IdentityTheft.gov.

The scale of losses documented in 2025 - 262 million dollars from just
over 5,100 complaints - reflects how effective these impersonation
schemes have become. The average loss per reported complaint exceeded
51,000 dollars. For many of those affected, the damage was not the
result of technical hacking but of a convincing conversation that asked
for one piece of information at the right moment.

References: Account Takeover Fraud via Impersonation of Financial Institutions | New trends in reports of imposter scams