Bank Impersonation Scams: Fake Fraud Department Calls

They Said They Were Protecting Your Money.

Bank impersonation scams: how fake fraud departments turn a security warning into a transfer, transaction approval or device takeover.

Bank impersonation scams often begin with the reassurance you most want to hear: someone has spotted a problem before it is too late.

The caller sounds calm. They know your name. They say a suspicious payment has been attempted and introduce themselves as a member of your bank’s fraud department.

You have not made that payment. You are worried, but also relieved that someone is helping.

Then they explain what you must do: move your money to a protected account, approve a notification to cancel a transaction, or install an application so they can secure your device.

You believe you are stopping a theft. But the instructions may be how the theft happens.

Why Bank Impersonation Scams Deserve Attention

In June 2026, the US Federal Trade Commission reported that consumers had reported US$3.5 billion in losses to impersonation scams during 2025. It identified fake security alerts, often supposedly from banks, as the starting point for some particularly costly schemes. That figure covers the wider impersonation category, not bank calls alone, and is not a worldwide estimate. FTC findings

South Africa’s SABRIC reported that digital banking fraud accounted for 65.3% of reported incidents in its 2024 statistics. This is broader banking-fraud data, not a measurement of fake fraud-department calls specifically. SABRIC report summary

The practical concern is not limited to one country. Regulators and consumer-protection agencies in the UK, Australia and the US describe the same central deception: criminals impersonate an organisation you trust and make a dangerous action sound like protection.

The Opening Warning May Be Invented—or Connected to Real Fraud

The conversation can begin with a telephone call, a text asking whether you recognise a payment, or an email directing you to a supposed banking website.

Sometimes the threat is completely invented. In other cases, criminals have already obtained information and use the call to get the missing approval or security code.

SABRIC’s 2024 report describes combined attacks in which a phishing message captures banking credentials, followed by a fake fraud-department call seeking a one-time PIN. The report also notes that callers may know personal details obtained through earlier scams or data leaks. SABRIC’s detailed report

Do not assume that a suspicious caller means your account is safe. End the conversation and contact the genuine bank promptly.

Why the Caller Appears Genuine

A familiar telephone number can make the call feel authenticated. However, the UK Financial Conduct Authority warns that criminals can alter caller ID to display a bank’s or another organisation’s number. This is called number spoofing. FCA banking-scam guidance

Knowing your name, address or some account information does not independently prove the caller’s identity. Nor does a convincing reference number.

The most useful question is not “Do they sound like my bank?” It is: “Have I independently established that I am speaking to my bank?”

Professional language, an accent, background office noise or apparent familiarity should not replace that check.

Trap 1: “Move Your Money to a Safe Account”

The caller says your existing account is compromised. They may describe a replacement account, temporary holding account or protected facility that supposedly keeps your savings beyond the criminals’ reach.

Australia’s Scamwatch has documented callers directing victims to transfer money for safekeeping or investigation. Its advice is to hang up and contact the bank using independently sourced details. Scamwatch bank-impersonation warning

Absa’s own warning describes impersonators claiming to have opened a new account to protect customers, then persuading them to transfer money into fraudulent accounts. Absa vishing warning

Do not transfer money on an incoming caller’s instruction to “protect” it. Contact your bank independently and ask it to investigate and secure your actual accounts.

Trap 2: “Approve This to Cancel the Payment”

An approval request appears in your genuine banking application. The caller explains that accepting it will reverse a payment, stop an attacker or complete a security check.

This is where two different questions matter: Is the notification genuine? And what action does it authorise?

A real notification can concern a transaction initiated by someone else. Standard Bank’s guidance explains that online card-payment approval requests display transaction details, including the amount and merchant. It tells customers to contact its fraud team if they receive an authorisation request for a payment they did not initiate. Standard Bank payment-approval guidance

Read the wording yourself. A request to approve a payment, add a beneficiary, register a device or change security settings should not be treated as cancellation because a caller says so.

Do not approve an unfamiliar action. The caller’s explanation does not change what the request authorises.

Trap 3: “Read Me the Security Code”

The caller says the code proves your identity or allows them to cancel the suspected fraud.

The FTC warns that sharing a verification code can allow a criminal to authenticate as you. It specifically identifies code requests from supposed bank or investment-company fraud departments as a scam warning. FTC fraud-call advice

Do not disclose banking passwords, PINs, transaction codes or app passcodes to an incoming caller. If verification is genuinely needed, end the call and follow your bank’s independently confirmed process.

A code arriving from the real bank does not prove the person requesting it works there.

Trap 4: “Install This So We Can Secure Your Device”

The caller claims your phone or computer is infected, your banking app needs repair, or a technician must inspect the problem.

Scamwatch warns that impersonators ask people to install screen-sharing or remote-access software, then use the access to steal information or money. Some named applications are legitimate support tools; the danger is granting access to an unverified person. Scamwatch remote-access warning

Depending on the software and permissions, access may expose files, messages, open applications or information entered during the session. The caller may guide you through banking actions while observing or controlling the device.

Do not install software or grant screen access because an unexpected caller says it will protect your bank account.

Trap 5: The “Investigation” That Keeps You Isolated

The caller may transfer you to another supposed department, tell you an employee is involved, or warn you not to discuss the matter.

The FTC has documented layered impersonation schemes in which one supposed organisation hands the victim to another, including fake government officials. The changing voices can make the story appear independently confirmed when it is part of the same deception. FTC research on false security alerts

Treat instructions to remain on the line, conceal the reason for a payment or avoid your bank’s normal channels as reasons to stop.

A claim that the branch or fraud team cannot be trusted should not leave the caller as your only source of truth.

But Genuine Banks Can Call About Fraud

It would be misleading to say every bank call is fraudulent. Banks can contact customers about suspicious activity.

Standard Bank, for example, describes a genuine in-app fraud-alert process that can lead to a consultant calling after a customer reports an unrecognised payment. Standard Bank fraud-alert process

The safer approach is independent verification, not ignoring all warnings. Some institutions provide dedicated in-app caller checks. Australia’s CommBank offers CallerCheck to help confirm eligible bank calls. Availability and procedures differ between banks. CommBank CallerCheck

Learn your own bank’s official process before an urgent call arrives. A screenshot or message supplied by the caller is not a substitute for using that process yourself.

How to Verify a Fraud Warning Safely

1. Stop the conversation. Do not transfer money, share codes, approve requests or download software while the caller directs you.
2. End the call completely. Do not accept a transfer to another supposed department as independent verification.
3. Source the contact details yourself. Use your bank card, statement or an established official banking application. Do not use a number from the suspicious message or simply redial the incoming call.
4. Explain the warning to the genuine bank. Ask whether there is suspicious activity and what must be blocked or secured.
5. Read each action before confirming it. Establish whether you are reporting fraud or authorising a transaction or security change.

The FCA recommends hanging up on suspicious calls and contacting the organisation through independently verified details. FCA verification advice

If remote access may be active, use another trusted device or telephone to contact the bank. Do not continue banking through a device the caller may control.

Already Followed Instructions? Act Immediately

Contact the genuine bank first. Tell it exactly what happened: whether you transferred funds, disclosed a code, approved a request, added a beneficiary or allowed device access. Ask what can be blocked, secured, recalled or disputed.

Do not wait for the caller to finish the “investigation”. The FTC recommends immediately contacting the payment provider after a scam and asking whether reversal is possible. Recovery depends on the circumstances and is not guaranteed. FTC response guidance

If device access was granted, disconnect the affected device from the internet. Use a trusted device to secure important accounts, and obtain reputable technical assistance before using the affected device for banking again. Australia’s cyber-security guidance recommends disconnecting compromised devices, changing passwords and checking for malicious software. Australian cyber-security recovery guidance

Ask the bank about unfamiliar devices, beneficiaries, contact-detail changes and recent transactions. Secure your email too, since it may be used to reset other accounts. Keep call logs, messages, receipts and the names of installed applications, but do not delay urgent bank contact to collect evidence.

If your phone unexpectedly loses service during suspicious activity, contact your mobile provider as well. Scamwatch identifies unexplained loss of service as a possible SIM-transfer or account-takeover warning, although an ordinary network problem can also cause it. Scamwatch account-takeover guidance

Reporting and Disputing the Loss

Report suspected fraud through the appropriate police or cybercrime channels in your country. Keep the bank’s incident reference, your timeline and copies of communications.

Reimbursement rules differ between countries, payment types and circumstances. Do not assume either that every loss must be refunded or that approving a transaction automatically ends your right to complain.

If you dispute the bank’s response, request its written decision and use its formal complaints process. In South Africa, the National Financial Ombud’s Banking and Credit Division offers free dispute-resolution services for eligible unresolved complaints after the provider’s usual process has been exhausted. NFO guidance

For a wider response checklist, read What to Do Immediately After Being Scammed. Our Old Scams, New Technology guide explains how familiar impersonation tactics have evolved.

Protection Should Not Depend on Trusting an Unknown Caller

This scam works by turning a sensible concern into a dangerous instruction. You want to protect your savings, so you follow the person who appears to have noticed the threat.

There is no shame in being frightened by a convincing warning. But you can interrupt the sequence.

Hang up. Contact the bank independently. Read what you are authorising.

AdUncovered’s research is not an emergency banking service and cannot block transactions or guarantee recovery. If your account may be compromised, contact your bank first.

They said they were protecting your money. Before following their instructions, establish who “they” really are.