Calls and texts from “your bank’s fraud department”

How it starts

It often begins with a text that looks like a real fraud alert: a large purchase you didn't make and a request to reply. The FTC lists fake fraud alerts among the most reported text scams of 2024, and describes the next step in its October 2024 alert "Three ways scammers try to steal your money": once you respond, scammers posing as your bank draw you into a fraud story and promise to help, but drain your account instead.

Sometimes it starts with a call. Caller ID may show your bank's name or number. The FTC explains that scammers use technology to change the phone number that appears on your caller ID, so a familiar name on the screen doesn't tell you who's calling.

Requests that give it away

Whatever the story, these calls come around to something a real fraud department that calls or texts you won't ask for. Two of them are below. Others ask for your username or password, or send a link that seems to be for reporting the fraud: the FBI warns that a caller posing as bank staff may send a link to a phishing website that the account owner believes will report the fraud, and says, "Companies generally do not contact you to ask for your username, password, or OTP" (a one-time passcode). If a caller asks for any of these, hang up and call the number on your card.

1. "Read me the code we just sent." Banks send one-time codes so that only you can get into your account. The FBI's November 2025 alert on account takeovers explains what happens next: criminals posing as bank or support staff collect your password and one-time code, reset your password and lock you out. By the time of that alert, the IC3 had received more than 5,100 complaints reporting account-takeover fraud of all kinds since January 2025, with losses over $262 million. The FTC's March 2024 alert, "Never move your money to ‘protect it.’ That’s a scam," puts it simply:

"No caller — especially someone from your bank’s fraud department — will ever ask for the verification code."

Federal Trade Commission

2. "Move your money to a safe account." The caller says your account has been hacked or is being used for fraud, and the only fix is to move the money somewhere "safe." The same FTC alert:

"Your money is fine where it is, no matter what they say or how urgently they say it. Moving it means you’ll lose it, not protect it."

Federal Trade Commission

Some versions add a second or third caller, posing as law enforcement or as someone from the Federal Reserve or another government agency, who confirms the story. The FBI calls this the "Phantom Hacker" pattern: a tech-support impostor, then a bank impostor, then a government impostor, with victims told not to tell anyone the real reason they were moving their money. The FTC's July 2025 alert is direct about the last step: no one from the government will ever tell you to buy and deliver gold bars, move your money, or give cash to anyone.

How to reach your real bank

1. Hang up. You don't need a reason, and you don't need to be polite about it. A real bank will be there when you call back.
2. Call the number on the back of your card, or the one on your statement. Don't call back the number that called or texted you, and don't use a number from a search ad. The FBI suggests signing in through a bookmark rather than a search result or an ad.
3. On a landline, use a different phone if you can. North Carolina's Department of Justice has warned that a caller can stay on a landline after you hang up, so when you pick up again to call your bank you're still connected to them. If you must use the same landline, it suggests waiting at least 20 minutes before you lift the receiver, and listening for a normal dial tone before you dial.
4. Ask the bank whether it really sent the alert, and whether the purchase is yours. If the bank flagged it, its records will show that.
5. Talk to someone you trust before you move any money for any reason a caller gave you.

If you already shared a code or moved money

Call your bank at the number on the back of your card right away, from a different phone if you can, and ask them to recall or reverse the transfer. If the caller used a code or password you gave them to take money out of your account, tell the bank it was a transfer you didn't authorize: the Consumer Financial Protection Bureau says that when someone is "fraudulently induced into sharing account access information" and it is used to make an electronic transfer from their account, the federal rule (Regulation E) treats the transfer as unauthorized, and its example is a caller pretending to be from the bank who gets a "texted account confirmation code." Report it right away: the time limits are on our page about a card number or bank details you gave. The FBI's 2025 report is plain about timing: "If you discover a fraudulent transfer, time is of the essence." Its Recovery Asset Team works with banks to try to freeze money: in 2025 it helped freeze $32.9 million of the $65.4 million reported lost in 642 cases involving people aged 60 and over. The FBI adds that "Different financial institutions have varying policies," so ask your bank what it can do. File a complaint at ic3.gov right away too, with the full transaction details: the FBI says to report a fraudulent wire transfer immediately to both your bank and IC3, and that "IC3 may be able to assist both the financial institutions and law enforcement in freezing funds." It asks people to include the words "Account Takeover" in the description when that's what happened. If you handed over cash or gold, or put cash into a crypto ATM, see what to do for each kind of payment. Then change your passwords. The rest of the steps are on our "if you clicked or paid" page.

Related patterns

• Pop-ups and calls about a problem with your computerA warning that won't close, and a number to call.
• Calls and messages claiming to be the IRS, Social Security or MedicareAn agency, a threat, and a payment only they accept.
• “Your account is locked” and other account warningsA problem with your account, and a link to sign in and fix it.