What You Need to Know to Protect Yourself Against Bank Scams

It can be hard to tell whether you’re being contacted by your bank or a criminal

Patrick J. Kiger,

AARP

Comments

En español

Published August 02, 2023

/ Updated August 12, 2024

an image of a bank building with forboding eyes lurking out of it

Benedetto Cristofani

In this story:

Bank scams increase • How scams work • Create urgency • Protect yourself • Report scams

Pittsburgh resident Molly Sinclair recently received ominous-sounding messages from two local banks where she’s a customer. One warned that her account had been locked because of unusual activity and instructed her to click a link in order to verify the transaction. The other simply said that her account was locked and gave her a phone number to call.

Skeptical but alarmed, Sinclair got on her laptop and went to the website for one of her banks, just to reassure herself that her money was still there. “The first thing that popped up on its home page was a scam alert,” she recalls. It warned about fake text notifications like the ones she had received.

She’s glad she didn’t click on that link or make that call.

You may have received these messages, too. In 2024, the Federal Trade Commission (FTC) reported that business impersonation scams, together with government impersonation scams, accounted for nearly half the scams reported to the agency. The losses from these scams topped $1.1 billion last year, more than three times what consumers reported in 2020. In that period, reports of contact by text increased more than 100 percent. (These crimes are notoriously underreported, however, so the number of people affected and the amount lost are probably far higher.)

If you have signed up for text notifications from your bank, it’s easy to mistake the scam texts for legitimate bank alerts. After all — as we all know — fraud is rampant.

“People are accustomed to getting texts from banks to prevent fraud,” notes Emma Fletcher, a senior data researcher in the FTC’s Division of Consumer Response & Operations. “There’s a certain irony that scammers are now using this to perpetrate fraud.”

How bank impersonation scams work

They warn you about “fraudulent activity” on your account. Bank impersonation scammers, pretending to be security departments at banks, send out text messages, emails and robocalls that warn people of unusual, possibly fraudulent activity that requires immediate action. In reality, they’re trying to get the recipients to provide account numbers and login information, or to transfer their funds for safekeeping into accounts controlled by the criminals. In the process, they also may steal targets’ personal information, which can be used to commit identity fraud. (The Perfect Scam talks to a small nonprofit targeted by criminals who impersonated their bank.)

They ask you to verify large purchases charged to your account. Some fake bank notification texts warn the target that an account has been locked, while others ask the person to verify a large purchase that supposedly has been made at a store. “If they reply ‘no,’ which many people might do reflexively, they’ll get a call from someone claiming to be the bank,” Fletcher says.

“The text messages from our bank to verify transactions are generated by the bank’s electronic fraud controls — not by humans — so an immediate follow-up call from the bank is a bright red flag of a scam attempt,” says Kathy Stokes, director of fraud prevention programs with the AARP Fraud Watch Network.

They ask you to cut up your card. The FBI recently warned of scammers who call and tell you need to cut up your card due to fraudulent activity but ask you to leave the card chip intact. They then say they are sending a “bank representative” to pick up the card. They may try to get you to tell them your PIN number and then use that to empty your account.

Fake bank messages try to create a sense of urgency

Typically, a scammer on the phone will try to alarm the people being targeted, saying that they must take immediate action to protect their accounts from being emptied.

“They will be walked through a series of steps that they’ve been led to believe will cause the fraudulent purchase or transfer to be reversed,” Fletcher says. But the money is actually being transferred into the criminal’s account.

Sometimes the scammers will guide targets to sophisticated replicas of actual bank websites.

“Other than a different web address, you really can’t tell that they’re fake,” explains Aaron Foss, founder of Nomorobo, a security company that specializes in blocking robocalls and spam text messages for its clients. “They use fear to get people to quickly tap on the link and not look at the URL too closely.”

The object in such cases is to steal victims’ login credentials and other personal data.

Bank impersonation robocalls, meanwhile, aim to connect victims to a live scammer, who then carries out the scams noted above. Or sometimes the criminal on the phone will tell victims to download remote-access software, which people don’t realize will actually give the scammers access to their computers, Foss says.

How to protect yourself against bank text scams

Business impersonation scams

Never click on links. If you get an email or a text claiming to be from your bank, don’t click on the link it provides (even if you’ve signed up for text alerts). Instead, go to the bank’s website. Use the URL listed on your statements or that you’ve previously bookmarked, and check for any alerts on your account.

Hang up. Then contact your bank in a way you know to be legitimate, either online or by calling the phone number on your statement or debit card.

Never provide account data or personal info. As the American Bankers Association’s banksneveraskthat.com website reminds consumers, banks don’t ask for your account number, PIN or password during a phone call or in a text or email — and will never ask for a one-time login code. Never share such confidential details unless you’ve called the number on the back of your bank card.

Don’t rely on caller ID. Scammers can use technological tricks to display actual bank phone numbers or even the name of the bank.

Be wary of a message or caller insisting that you take immediate action. Scammers try to pressure you to act quickly, to make it more difficult for you to think clearly.

When in doubt, seek assistance. If you’re unsure what to do in response to what appears to be an alert from your bank, stop and ask a trusted person — a friend, family member or coworker — to help you.

Reporting bank impersonation scams

Notify your financial institution of the occurrence. Include a screenshot of the text. (Here’s how to create one.) If you lose money to this scam, contact your bank immediately — it may be able to halt the transaction.

File a police report. The documentation may be of value if there is some means of recouping your loss. For example, some home insurance providers offer fraud loss protection.

File reports with the federal government. The FTC and the FBI’s Internet Crime Complaint Center use fraud reports to target their investigations. The more information they have, the better they can identify patterns, link cases and ultimately catch the criminals. Contact the FTC at reportfraud.ftc.gov and the FBI at IC3.gov.

Call the free AARP Fraud Watch Network Helpline. Call 877-908-3360 to speak with trained specialists who can provide support and guidance on what to do next and how to avoid scams. The AARP Fraud Watch Network also offers online group support sessions.

%{postComment}%

Patrick J. Kiger is a contributing writer for AARP. He has written for a wide variety of publications, including the Los Angeles Times Magazine, GQ and Mother Jones, as well as the websites of the Discovery Channel and National Geographic.