Someone says they're from your bank

No bank protects your money by asking you to move it somewhere else. Not to a “safe account,” not to yourself through Zelle, not into cash, gold, or a Bitcoin ATM.

If it’s happening now

You hung up and gave them nothing. You’re done. Call the number on your card if you want the account checked. They may call back from another number, or as a “supervisor.” Same move.

They’re on the phone. Hang up. You don’t owe them a reason. Then call the number on the back of your card, not a number they gave you. No card? It’s on your paper statement and in the bank’s app.

You’re at the bank or an ATM with them on the line. Hang up before you take out or hand over anything. If there’s a teller, tell them what the caller told you to do. A caller who tells you to lie to the bank is the scam.

A courier is on the way for your cash, gold, or card. Don’t hand anything over. Call 911.

It’s a text or email. Don’t tap the link or call the number in it. Check your account in the bank’s app, or call the number on your card.

They’re on your computer. Hold the power button until it shuts off. Then call the bank from your phone. Full steps: Someone is on the line or on my screen right now.

What to say

• I'm going to hang up and call the number on my card.

• Someone pretending to be your fraud department called me, and I did what they asked. I need to report fraud, stop anything still pending, and lock my online banking. Can I get a case number?

• Someone pretending to be you got me to read them a code, and they used it to move money I didn't send. I want it handled as an unauthorized transfer under Regulation E.

• Can you send me that decision in writing, with the documents you based it on?

If something already left your hands

Call the number on your card before anything else on this list. Ask for a case number and write it down. Once the bank knows, report it at ReportFraud.ftc.gov and forward any scam texts to 7726.

You moved money

Ask the bank to stop or reverse the payment, and whether it qualifies for any scam reimbursement. Zelle says certain impostor scams do.

If you sent it yourself, the bank may count it as authorized. The FTC says you probably won’t get it back. If the bank says no, ask for the decision in writing, with the documents it relied on. Then file a complaint at consumerfinance.gov/complaint.

Cash or gold handed to a courier, or put into a Bitcoin ATM, is out of the bank’s reach. Report it to the FBI at ic3.gov with the Bitcoin ATM receipts, the QR code or address they sent you, and anything you know about the courier. Steps: cash or gold, Bitcoin ATM.

If someone calls later offering to get it back, that’s a second scam. Someone offers to get my money back.

If you’re 60 or older, or helping someone who is, the National Elder Fraud Hotline assigns a case manager to help with the reports. It won’t call you first.

You read them a code

Tell the bank someone posing as them got a code. Ask them to lock your online banking, remove devices you don’t recognize, check that the phone number and email on file are still yours, and look for transfers and anyone newly added to send money to. Then change your online banking password.

If money then left and you didn’t send it, federal rules (Regulation E) treat it as an unauthorized transfer, even though you gave them the code. The CFPB names this exact case. If the bank pushes back, use the Regulation E line at the top. This doesn’t cover wire transfers. If money left by wire, ask the bank to recall it on the same call.

Call today. The same rules limit what you can owe, and the limit is lowest when you report within two business days of realizing a scammer has the code. The bank has 10 business days to look into it, or it has to put the money back while it finishes (it can hold back up to $50). If it wants this in writing, send it within 10 business days of your call.

You gave a card number, password, or Social Security number

Card number. Report it and ask for a new card. If you still have the card, federal law says you aren’t responsible for charges you didn’t authorize. On a debit card, that holds if you report within 60 days of the statement that shows them.

PIN. Ask for a new card and PIN on the same call.

Password. Change it in the bank’s app or on the site you typed in yourself. Then turn on the strongest sign-in check the bank offers: a passkey or an authenticator app if it has one, text codes if that’s all it has. Used that password anywhere else? Change it there too.

Social Security number. Freeze your credit with Equifax, Experian, and TransUnion. It’s free. Steps: I gave out a code, password, or card number.

You let them onto your computer or phone

Turn it off. From another device, call the number on your card, tell them someone was on your computer, and change your bank and email passwords. Before you bank on that computer again, remove the program they had you install (AnyDesk, TeamViewer, or similar), update the security software, and run a scan, or have someone you trust do it. More: cleaning up after someone was on your computer.

What it looks like

2:47 p.m. Your debit card was just declined at checkout for a $1,249.00 TV.

(312) 555-0142

Text Message
Today 2:47 PM

FreeMSG-Fernmont Bank Fraud Center: Did you use debit card ending 4471 for $1,249.00 at BEST BUY OH? Reply YES or NO. Reply STOP to opt out.

What do you do?

• Call the number on the back of your card before replying
• Reply YES, then run the card again
• Reply NO, just to be safe

Show the answers

• Okay Call the number on the back of your card before replying Safe, and the bank can clear the block on that call. It's just slower.
• Best move Reply YES, then run the card again It matches what you just bought, has no link, and asks only YES or NO. A YES can't move money or unlock anything. The FTC says not to reply to unexpected texts. This one isn't unexpected: you made the purchase a minute ago.
• Wrong move Reply NO, just to be safe NO reports your own purchase as fraud. The charge stays blocked, and the bank may lock the card until you call.

Banks do text about fraud. Answer YES or NO when it matches what you just did. If a call, a link, or a request for a code follows, stop and call the number on your card.

9:14 a.m. You just replied NO to a text about a $612.40 Walmart.com charge you didn't make. The number now calling you matches the back of your card.

(312) 555-0136

Incoming call · 9:14 AM

1. Caller Hi, this is Daniel with Fernmont Bank's fraud department, employee ID 40217. I'm calling about the Walmart.com charge you just said wasn't you.
2. Caller I have your debit card ending in 4471. Was the $86.12 at Kroger yesterday you?
3. You Yes, that was me.
4. Caller Okay. I've blocked that charge. I'm also seeing a new device signed in to your online banking this morning.
5. Caller I'm texting you a verification code now. Read it back to me and I'll remove that device.
6. A text arrives with "482913 is your Fernmont code. Fernmont will never call you to ask for it."
7. Caller The text says we never call for it. That's about people pretending to be us. I'm the fraud department.

He has your last four digits, yesterday's grocery charge, and your bank's real number on the screen. What do you do?

• Read him the code. A stranger wouldn't know all that
• Tell him you'll call back, hang up, and dial the number on your card yourself
• Ask him to read you your full account number first

Show the answers

• Wrong move Read him the code. A stranger wouldn't know all that He may have sent that text himself. Your last four digits turn up in breaches and on receipts. Yesterday's Kroger charge is in your online banking, which he may already be in with a stolen password. The code is what he still needs to move money.
• Best move Tell him you'll call back, hang up, and dial the number on your card yourself Scammers can make any name or number show up on caller ID, including your bank's. The number on your card only protects you when you're the one dialing. If there really is a new device, the fraud team will see it when you call.
• Wrong move Ask him to read you your full account number first If he's signed in to your account, he can read it off the screen. A right answer proves nothing, and you're still on his call.

Real banks sometimes call after you reply NO. So do scammers who sent a look-alike text. Your bank's number on the screen doesn't mean your bank is on the line. The number on your card works when you dial it.

You hung up and dialed the number on the back of your card yourself.

(312) 555-0136

Outgoing call · 9:21 AM

1. Rep Fernmont Bank, this is Teresa. Can I get the last four digits of your card?
2. You 4471.
3. Rep Thanks. I'm texting a code to the phone we have on file. Can you read it to me?
4. A text arrives with "731602 is your Fernmont code. Fernmont will never call you to ask for it."

The text says Fernmont will never call to ask for it. What do you do?

• Read her the code
• Refuse. You never read a code to anyone
• Hang up and dial again in case it's the scammer

Show the answers

• Best move Read her the code You dialed the number on your card. Some banks check who's calling this way. 'Never call you' means they won't start the call.
• Okay Refuse. You never read a code to anyone Safe, but she can't help until you're verified. Ask what else she can use.
• Wrong move Hang up and dial again in case it's the scammer A number you dialed from your card reaches your bank. Redialing just costs time.

What matters is who started the call. If you dialed the number on your card, reading the code back is one way the bank checks it's you.

What they’ll ask for

Each of these is the scam. The move doesn’t change: hang up and call the number on your card.

“Move your money to a safe account.” There is no safe account. If your account is really at risk, the bank can lock it. It won’t ask you to move anything.

“Send it to yourself with Zelle so we can reverse the charge.” They have you type in your own name with their phone number or email. The money goes to them.

“Read me the code we just texted you.” Whoever has it can sign in, add a device, or approve a payment as you. Your bank won’t call you and ask for it. When you call them, some banks will.

“Tap Approve on the alert in your banking app.” Same as reading them the code. Don’t approve it.

“Confirm your PIN or password so I can verify you.” They called you. Your bank doesn’t need either one to protect your account.

“Install this app so I can check your account.” It lets them use your computer and your bank account while you watch. Your bank won’t ask you to install one.

“I’m transferring you to the Federal Reserve” (or the FTC, or a federal agent). Same scam, second voice. No agency takes over your bank account by phone.

“We’re sending a courier for your card.” “Withdraw cash.” “Buy gold.” “Use a Bitcoin ATM.” No bank sends someone to your house for cash, gold, or your card.

“Don’t tell the teller. It could be an inside job.” The teller can stop it. Tell the teller.

“Stay on the line while you drive to the bank.” Hang up first. A real fraud team doesn’t need to listen in.

What not to waste time on

Working out whether the caller is real. Caller ID can show your bank’s real number, your last four digits are easy to get, and a caller who’s already in your online banking can read you your recent charges. If it really was your bank, the fraud team will have the same notes when you call.