The Federal Trade Commission warns that a fast-growing con now opens with a phone call or a text from what looks like a bank’s own fraud department, and it has become one of the costliest impersonation schemes reported in the country. The pitch is engineered to sound like protection: an account has supposedly been breached, suspicious charges are pending, and the only way to keep the money safe is to move it immediately. That instruction is the tell. A legitimate bank never asks a customer to transfer funds to “protect” them, and the moment a caller does, the story falls apart.
How a fake fraud alert is built to feel real
The scam borrows the bank’s own language. A caller or text claims to be from the fraud or security team, references a charge the account holder does not recognize, and asks the person to “verify” or “authenticate” the account before it is locked. The number on the screen may even match the bank’s published line, because caller ID can be spoofed to display any name or number the scammer chooses.
The FTC reports that bank impersonation was the most common scam delivered by text message in recent tallies, with the volume of these messages rising sharply since 2019. Text is attractive to the thief because it lands instantly, looks like an automated alert, and invites a quick reply or a tap on a link that routes the target to a fake login page or a live “agent.”
Urgency is the engine. The script insists the account will be drained within minutes, that a transfer is already in motion, or that a one-time passcode must be read aloud to stop it. Every element is designed to keep the target reacting rather than pausing to call the bank independently.
Free retirement updates: Social Security and Medicare change every year, and nobody sends you a memo. Our free Retirement Shield newsletter breaks down what changed and what to do. Get it free in your inbox.
Why “move the money to protect it” is the red line
The single instruction that separates a scam from a real bank contact is the demand to move money. The FTC is blunt on the point: no genuine bank tells a customer to transfer, wire, or withdraw funds to keep them safe. Anyone who says the money must be moved quickly to protect it is, by definition, running a scam.
The FDIC echoes that warning in its guidance on bank impersonation and fake banks, noting that scammers pose as bank staff to pressure people into handing over account credentials or sending money to a so-called safe account they secretly control. A real institution already has the account information it needs and would never ask a customer to read back a full password or a security code.
The Federal Communications Commission adds that the safest move is to hang up and dial the bank directly, using the number printed on the back of a debit or credit card or on an account statement. Its scam-alert page stresses that a customer should never trust a callback number supplied by the person who initiated the contact, since that line rings straight back to the crew.
How the money disappears, and why recovery is hard
Once a target is convinced, the payout channels are chosen for their speed and finality. Scammers steer people toward wire transfers, instant peer-to-peer apps, cryptocurrency ATMs, or even couriers sent to pick up cash and gold. Those methods share one feature that traditional theft did not: the transfer clears in minutes and, in most cases, cannot be reversed once it lands in the thief’s hands.
Older adults are a frequent target, and the losses in this category run high because the con often drains an entire checking or savings balance in a single sitting. The FTC’s broader guidance on avoiding imposter scams notes that impersonators succeed by combining a trusted name with a manufactured emergency, a formula that works across fake calls from banks, government agencies, and well-known companies.
The response that actually protects an account is unglamorous. A person who receives an unexpected fraud alert should not click a link, call a number in the message, or act on anything the caller demands. Contacting the bank through a known channel confirms in seconds whether any alert is real, and the answer is almost always that no such alert was ever sent.
Reporting matters even after the fact. A customer who has moved money or shared credentials should call the bank’s real fraud line at once, ask about stopping or recalling the transfer, and file a report with the FTC. The unresolved tension is speed: real-time payment rails now settle faster than fraud teams can intervene, which is exactly why the con leans so hard on the seconds between the alarm and the transfer. The defense is not technical skill but a single habit — treating any request to move money as the proof that the caller is not the bank.
This article was researched and drafted with the assistance of artificial intelligence.
More Financial Reading
