Bank impersonation calls: how the “your account is locked” scam works

How the call usually starts

Bank impersonation scams almost always begin with urgency. A caller says there is a suspicious payment on your account, that your card has been cloned, or that your online banking has been locked “for your protection”. The caller sounds calm and professional, and may already know your name, the last digits of your card, or which bank you use.

That information is meant to make the call feel genuine, but it proves very little. Names, phone numbers and partial card details turn up in data breaches and leaked customer lists.

The three tricks behind most bank impersonation calls

1. “Your account is locked”

The caller tells you your account is frozen or restricted, and that they need to “verify” you before unlocking it. Verification means reading out your online banking password, PIN, card number or security answers. A real bank may ask security questions when you call them, but it will not ask for your full password or PIN on any call.

2. One-time code theft

This is the most common technique today. While you are on the phone, the scammer tries to log in to your account, add a new device, or approve a payment. Your bank sends you a one-time passcode by text or app notification. The caller then asks you to read that code back “to confirm your identity” or “to cancel the fraudulent payment”.

The code does the opposite. It authorizes whatever the scammer is doing. Nobody at a genuine bank needs a code that was sent to you.

3. The “safe account” transfer

Here the caller claims your account has been compromised, perhaps by a bank employee or a hacker, and that you must move your money to a new “safe” or “holding” account while they investigate. They may stay on the line while you transfer, coaching you on what to tell the bank if it asks why.

There is no such thing as a safe account. Banks do not ask customers to move money to protect it. Because you made the transfer yourself, recovering it can be much harder than with a card payment.

Why caller ID doesn’t prove anything

Caller ID can be spoofed, which means the number shown on your screen can be set by the caller. Scammers often display the bank’s real customer service number, so a quick search seems to confirm the call is genuine.

Phone networks in some countries now verify caller ID more strictly, but spoofed calls still get through, especially from abroad. Treat the displayed number as a claim, not proof. A reverse lookup on MobileTracking can show whether others have reported the number, but even a clean result does not make an unexpected call from “your bank” safe. The safest check is always to hang up and call back yourself.

Red flags to listen for

• Pressure to act right now, before you “lose everything”.
• A request for a one-time code, PIN, full password or card security code.
• Instructions to move money, buy gift cards or withdraw cash.
• A request to install a screen-sharing or remote access app.
• Being told to stay on the line while you call the bank’s number. On some landlines, a call is not fully disconnected until both sides hang up.

What to do when a “bank” calls you

1. Don’t confirm anything. Don’t give codes, passwords or card details, and don’t agree to move money.
2. End the call. You can say you will call the bank back. A genuine bank will understand.
3. Wait, or use another phone. Wait a few minutes before calling, or use a different phone, so you are not reconnected to the scammer.
4. Call the number you trust. Use the number on the back of your card, on a statement, or inside your bank’s official app. Don’t use a number the caller gave you.
5. Check your accounts. Log in through the app or a website address you type yourself and look for unfamiliar payees, devices or transactions.
6. Look up and report the number. Search the number on MobileTracking and add a report so the next person gets a warning.

If you already shared a code or sent money

1. Call your bank on its official number and tell them you have been the victim of fraud. Ask them to freeze the account, stop pending payments and try to recall any transfer.
2. Change your online banking password and, if you use it, your email password, from a device you trust.
3. Remove any app the caller asked you to install.
4. Note the number that called, the time and any payment details.
5. Report it to the national fraud reporting service for your country.

Where to report bank impersonation scams

• United States: ReportFraud.ftc.gov
• United Kingdom: Action Fraud
• Canada: the Canadian Anti-Fraud Centre
• Australia: Scamwatch
• India: the Chakshu facility on the Sanchar Saathi portal

For related tactics, read our guides on parcel fee text scams and fake tech support calls. More advice is in our guides.