Your phone rings. You glance at the screen and recognise your bank’s name or a familiar phone number.
You answer.
The person on the other end sounds professional. They know your name, speak confidently, and tell you that something suspicious has happened to your account. Perhaps there has been an unusual transaction. Perhaps someone is trying to access your online banking.
They say they are calling from the bank’s fraud department, and they want to help you protect your money.
Naturally, you pay attention. If your money is at risk, you want to act quickly.
Then comes the instruction: move your money into a secure account, confirm a security code, or follow a link to verify your identity.
It sounds reasonable. The caller seems to know what they are talking about. The phone number looks genuine.
But what if the person trying to protect your money is actually trying to steal it?
This is the reality of bank impersonation fraud, a type of scam that exploits one of the most valuable things criminals can gain from a victim: trust.
Most people imagine a scammer as someone sending badly written emails or suspicious text messages from an unfamiliar number. Those scams still exist, but modern fraud can be much more convincing.
A criminal does not necessarily need to break into your bank account. Sometimes, they simply need to persuade you to give them access or authorise a payment yourself.
The Financial Conduct Authority describes phone-based impersonation scams as vishing, short for voice phishing. Criminals pretend to represent a trusted organisation and use deception to obtain sensitive information or money. They may also manipulate caller ID so that the number displayed on your phone appears legitimate. (Source: FCA)
That last detail matters.
We have become accustomed to using familiar phone numbers, logos and names as signs of legitimacy. When a call appears to come from our bank, we may lower our guard before the conversation has even begun.
Imagine receiving a call from someone claiming to work for your bank's fraud team.
They tell you that a suspicious payment has been detected. You do not recognise the transaction, so you become concerned.
The caller reassures you that they can help. They may ask whether you have recently made a purchase, accessed your account from a new device or shared your banking details.
Some of these questions may sound like ordinary security checks. The caller might even provide personal information that makes the conversation feel authentic.
Once they have gained your confidence, the pressure begins.
They may tell you that your account is under immediate threat, that a criminal has already gained access, or that you must act before another payment is taken.
The proposed solution varies. You might be asked to:
Each request is presented as a necessary step in protecting you. In reality, it may be the final step in the theft.
The important point is that these scams are rarely just about technology. They are carefully constructed conversations designed to influence how a person thinks and acts:
Spoofing the number, using customer service parlance, and reciting stolen personal details to disarm suspicion.
Fabricating an imminent loss or account breach, placing you into high-stress cognitive tunnel vision.
Prescribing a dangerous instruction (move funds, read OTP, authorize app) disguised as an official security procedure.
It is tempting to believe that people who understand technology or are generally cautious would never fall for a scam like this.
That assumption is dangerous.
Scammers do not necessarily succeed because their victims lack intelligence. They succeed because they exploit normal human reactions.
When someone tells you that your savings could disappear within minutes, your attention shifts towards solving the immediate problem. You may have less time to question the caller, verify their identity or consider whether the proposed solution makes sense.
This is particularly effective when the caller sounds calm, empathetic and authoritative.
There is also the problem of familiarity. We regularly receive genuine calls, texts and notifications from banks. A fraudulent communication can imitate the same language, design and procedures that we have learned to associate with legitimate banking.
Criminals may also use information gathered from previous data breaches, social media or other sources to make their approach more personal. They might know your address, the last few digits of your card, or which branch you opened your account with.
The result is a scam that feels less like an obvious attack and more like an ordinary customer-service interaction. That is why being alert to spelling mistakes or unfamiliar numbers is not enough. A convincing scam may have neither.
Not every unexpected call from a bank is fraudulent. Banks do contact customers about unusual activity, and legitimate security checks do happen.
The challenge is knowing when to stop and verify.
Pay particular attention when a caller does any of the following:
Insists that you must act immediately on the call to prevent losing your money or having accounts frozen.
Tells you to move funds to a new, temporary, holding, or supposedly 'secure' government/police vault.
Asks for your card PIN, online banking password, or one-time verification SMS code sent to your phone.
Asks you to open your banking app and tap 'Approve' on a security prompt or biometric authorization.
Instructs you to download software like AnyDesk or TeamViewer to 'scan your computer for viruses'.
Warns you not to speak to anyone else, including branch staff, family members, or standard phone support.
A caller may have a convincing explanation for every request. They may claim that the money is being moved temporarily, that a security code is needed to cancel a transaction, or that the process must remain confidential because branch employees are under internal investigation.
The safest response is also one of the simplest: end the call and contact your bank independently.
If the caller reports suspicious activity, you do not need to resolve it through that particular conversation. Hang up, then use the contact details on your bank card, an official account statement or the bank's official website.
In the UK, you can dial 159 from your mobile or landline to be connected directly and securely to your bank’s official fraud prevention service. It works like an emergency number for bank scams. (Source: Stop! Think Fraud)
Essential Rules for Every Call:
If you realise that you have responded to a scam, do not waste time blaming yourself.
Fraudsters deliberately engineer psychological panic and emotional overwhelm. Acting quickly is infinitely more useful than worrying about what you should have noticed earlier.
Use the verified phone number printed on the back of your debit card or dial 159. Explain exactly what happened: whether you disclosed security codes, approved an app push request, gave remote access, or initiated a transfer. Ask them to immediately freeze accounts and stop outgoing payments.
If you installed remote access software, disconnect your device from the internet (turn off Wi-Fi or unplug Ethernet) and uninstall the tool. If you shared any passwords that you also reuse across email or shopping services, change them immediately using another clean device.
In England, Wales and Northern Ireland, report suspected fraud through Report Fraud (the official national reporting service). If you are in Scotland, contact Police Scotland on 101 for direct reporting advice. The sooner reports are filed, the faster intelligence can be dispatched to freeze mule accounts.
Bank impersonation scams reveal something fundamental about modern cybersecurity.
We often focus on firewalls, complex passwords, encryption and the technical infrastructure organisations use to protect their customers. These controls matter immensely, but they cannot eliminate every risk created by human deception.
A criminal does not need to defeat a bank's technical security if they can persuade a customer to authorise a transfer or disclose information that helps them bypass it.
That makes verification a critical part of personal security.
The same principle applies to emails from supposed IT departments requesting password resets, text messages from parcel delivery companies asking for customs fees, calls from government agencies threatening arrest, and requests from colleagues to change bank details on an invoice. The communication may appear genuine, but its identity and instructions still need to be checked.
Security is not simply about recognising something suspicious. It is also about refusing to act until you have established that a request is legitimate.
The next time your phone rings and someone claims to be calling from your bank, remember that the person on the other end may sound genuine without being genuine.
They may know your name. They may know which bank you use. Their phone number may even look familiar on your screen.
None of those things proves their identity.
You do not need to panic, argue or work out whether the caller is a convincing liar. You simply need to take control of the situation.
A legitimate security problem can always be checked through a trusted channel. A scammer, on the other hand, depends on keeping you in the conversation long enough to make a mistake.
Your bank might be calling. But before you trust the voice, make sure you know who is really speaking.
This article is for public awareness and educational purposes. If you suspect fraud, contact your bank using independently verified details and follow official reporting guidance.
How open-source intelligence and public footprints enable precision social engineering.
Have a question or a suggestion? Prepare an email below. Feedback is private and is sent only when you press Send in your email app.
Likes and claps are your personal reactions on this device.
You can also email Poorna directly.
Your feedback stays private. Nothing is sent from this page automatically.