Bank Impersonation Scams & OTP Account Takeover

A bank impersonation scam is a fraud scheme where scammers spoof your bank's fraud department, claim an unauthorized wire is pending, and ask for a one-time passcode to 'cancel' it. Handing over the passcode authorizes the theft. Real banks never ask for one-time passcodes over incoming calls.

How Bank Impersonation and OTP Interception Work

Bank impersonation fraud is one of the fastest-growing and most financially devastating forms of voice fraud. Scammers combine caller ID spoofing with psychological panic to trick account holders into authorizing fraudulent wire transfers.

The scam unfolds in three calculated steps:

• The Fake Fraud Alert: The victim receives an urgent call or SMS displaying their bank's real name and customer service number on caller ID. The caller claims to be an investigator from the bank's fraud department, warning that an unauthorized wire transfer or Zelle transaction of thousands of dollars is currently pending.
• The Verification Trap: The scammer offers to "cancel the fraudulent transaction" or "reverse the charge." To do so, they state that the bank has sent a secure verification code to the customer's phone and instruct the customer to read it aloud to confirm their identity.
• Account Takeover: In reality, the scammer has already initiated an unauthorized transfer or password reset on the victim's online banking portal. The code sent by the bank is not a cancellation code—it is the one-time passcode (OTP) required to authorize the transaction. The moment the victim reads the code, the funds are transferred into the criminal's account. Targeted numbers are often selected through public databases, as explored in our guide on how to know if your number is targeted by spammers.

Voice-based impersonation tactics are broken down in detail in our glossary guide to vishing voice fraud.

What a Real Bank Will Never Ask You on the Phone

Financial institutions enforce strict security protocols regarding customer authentication:

• Banks never ask for one-time passcodes over the phone: One-time security codes sent to your phone are strictly for your personal use when logging in or making transactions. A bank agent will never ask you to read back a verification code over an incoming call.
• Banks never ask for your PIN or online password: Legitimate customer service agents have internal authentication tools and never require your secret PIN or banking password.
• Banks never instruct you to transfer money to "safe accounts": If an account is genuinely compromised, the bank freezes the account internally—they never tell you to wire funds to a third-party account or peer-to-peer app to protect them.

A customer once told our team that after receiving a fake fraud alert, they followed caller instructions to read back a verification code, resulting in immediate unauthorized account drainage. The emotional weight of discovering life savings drained in minutes led to severe personal crisis.

If you or someone you know is experiencing severe distress or crisis following financial fraud, please contact the 988 Suicide & Crisis Lifeline by calling or texting 988 (available 24/7, free, and confidential).

The Hang-Up-and-Verify Protocol

If you receive an urgent call from someone claiming to represent your bank:

• Hang up immediately: Do not engage, and do not trust the name or number displayed on your caller ID.
• Call the verified number on your physical card: Locate your physical debit or credit card and dial the customer service number printed directly on the back. This ensures you are speaking with legitimate fraud department staff.
• Freeze your account if compromised: If you suspect you shared credentials or codes, notify your bank immediately to freeze your online access and debit cards.
• Screen spoofed incoming calls on-device: Callro's 26-Layer Gauntlet Engine (explore Callro features) evaluates incoming calls on-device through 26 layers of verification — including STIR/SHAKEN cryptographic attestation, behavioral dialing patterns, and number reputation — to drop fraudulent calls before your ringer sounds.