Bank impersonation scams: how fake bank calls work and how to stop them
Impostors posing as the bank's fraud team are among the most costly scams. The script they follow, the 2025 losses, and what issuers can do at the moment of payment.
The call looks like it comes from the bank. The caller knows the customer's name, the last digits of their card and a recent purchase. There's suspicious activity, they say, and the money needs protecting right now.
The scale
The US Federal Trade Commission reported $3.5 billion lost to imposter scams in 2025, out of roughly $16 billion in total reported fraud losses, the highest on record. Bank impersonators reported the highest losses among business impersonation scams.
The script
- Urgency: your account is under attack, act now.
- Authority: the caller is from the fraud team, or works with the police.
- Isolation: don't tell anyone, don't hang up, the branch can't be trusted.
- Instruction: move money to a 'safe account', buy crypto or gift cards, or read out a code.
Why the usual checks pass
The victim logs in themselves, approves the payment themselves and enters the code themselves. Every identity check says yes, because it is the real customer. The fraud is in why they are paying, not who.
What helps at the moment of payment
- Tell cardholders, in the app, that the bank will never ask them to move money or buy crypto.
- Put that message in front of them at the moment it matters: during the payment, not in a newsletter.
- Make cancelling easy and blameless.
- Use context around the payment to decide when to show the warning, so genuine payments stay smooth.