Someone says they are calling from your bank?
Do not share a full password, PIN, verification code, card security code, or screen. Never move money to a “safe account.” End the call and contact the bank through its official app, your card, or a recent statement.
A convincing bank scam often begins with a sentence that sounds protective.
“Mr. Harris, we have stopped a suspicious payment from your account.”
The caller does not sound threatening. She sounds calm, patient, and concerned. She knows the customer’s name, the bank he uses, and the last four digits of his card.
For an older adult who has spent a lifetime protecting savings, that knowledge may feel like proof.
It is not.
The call that seemed designed to help
Imagine a 72-year-old widower named Robert answering his home phone after lunch.
The woman says she works in his bank’s fraud department. Someone tried to buy an expensive laptop with his debit card. She says the payment is blocked, but Robert must secure the account.
She asks for a six-digit text code, tells him to install a support app, and says his savings must be moved temporarily to a protected account.
Every instruction sounds connected to security.
Robert begins to read the code aloud. Then he notices a card his daughter placed beside the telephone:
“Banks do not need a code from an incoming call. Hang up and call the number on your card.”
He ends the call. When he reaches the genuine bank through the number on his debit card, the fraud team confirms there was no blocked purchase and no request to move his savings.
This illustrative story combines methods in official warnings: impersonation, leaked details, code theft, remote access, and the invented “safe account.” The scammer’s advantage is keeping a worried person inside one conversation.
This guide explains what banks will never ask you to share by phone and how families can protect aging parents without taking away independence.
Can a real bank telephone you?
Yes. Banks sometimes contact customers about unusual transactions, account changes, or suspected fraud. A genuine employee may ask whether you recognize a named transaction or may use limited identity checks under the bank’s procedures.
The safest rule is not, “My bank will never call me.” It is:
An unexpected call must never become the place where you disclose complete security credentials, approve an action you did not start, install access software, or move money.
Procedures vary by bank and country. A bank may ask you to confirm a transaction, use its official app, or visit a branch. It should allow independent verification.
The FTC recommends using the official bank app, a recent statement, or the number on the back of the card. Do not use a number or link supplied by the caller. Caller ID can be spoofed, and even the correct bank name on the screen is not proof.
Ask for the caller’s name, department, and reason for calling. Then end the call and initiate a new contact through a trusted channel.
1. Your full banking password or login credentials
Your online or mobile banking password is a key to the account. An incoming caller does not need it to investigate fraud.
Never read out your full password, mobile banking passcode, complete memorable word, or answers that could reset the account. A bank may use its own identification process when you contact it, but that is different from an unexpected caller collecting the credentials used to sign in.
Europol’s bank-vishing guidance warns against sharing an online banking password.
Safest response: “I do not disclose login details by phone. I will contact the bank through the official number.”
2. Your complete card PIN
A PIN is intended for use at a cash machine, payment terminal, or secure banking process. It is not a conversation code.
A scammer may call it a verification number, cancellation code, or four-digit security confirmation. The label does not matter. Never disclose the complete PIN to an incoming caller, type it into a telephone keypad at their direction, or hand your card to a courier.
Safest response: End the call. Lock the card through the genuine banking app if that feature is available, then contact the bank independently.
3. A one-time verification code or app approval
This request is especially dangerous because the message may arrive from the bank’s genuine system.
A one-time passcode, security token, or app notification proves that the account holder is performing a particular action. If a criminal already has a password, the code may let them enter the account, add a device, create a payee, reset a password, or authorize a transfer.
The caller may say, “Read the code so I can cancel the payment,” or “Approve the notification to block the transfer.” Read the entire bank message. It may reveal that the real action is a new device registration or payment approval.
The FTC warns that verification codes are for customers to use, not for callers to collect. Never approve a login, device, payee, or payment you did not initiate.
Safest response: “I did not request this code or approval. I am ending the call and contacting the bank.”
4. Card security and complete identity details
The three- or four-digit code on a payment card is commonly called a CVV or CVC. An unexpected caller should not need the complete card number, expiry date, and security code to stop fraud.
Also avoid disclosing a full Social Security or National Insurance number, passport details, security answers, or photographs of identification documents during an unverified call. A caller may already know your name, address, bank, or the last four digits of a card. Information from social media, stolen mail, marketing records, or a data breach is not proof of identity.
A genuine fraud alert may ask whether you recognize a named merchant or amount. You do not need to provide complete card credentials to answer.
Safest response: Call the number printed on the card. If documents are genuinely required, ask for the bank’s secure method of providing them.
5. Remote access to your phone or computer
A bank employee does not need to control your screen to protect your account.
Scammers may describe screen-sharing or remote-support software as a security tool. Once access is granted, they may watch you enter credentials, read codes, move money, or open identity documents.
The UK Financial Conduct Authority identifies an unexpected request to share a screen or provide remote access as a scam warning. Do not install an app, share a screen, or enter online banking while another person can view or control the device.
Safest response: Disconnect the call and internet connection if access has begun. Use a different trusted device to contact the bank.
6. A transfer to a “safe account”
There is no protective account waiting for you during an unexpected call.
The caller may claim that your account has been compromised, a dishonest employee is stealing money, or the police need help with a secret investigation. The destination may have a reassuring name such as “security account” or “protected escrow.”
The FTC states that anyone who tells you to move money to protect it is a scammer. Europol also warns that a bank will not ask a customer to transfer money to another account because of a telephone request.
Do not create a new payee, increase a transfer limit, split a payment into smaller amounts, or move retirement savings at the caller’s direction.
Family rule: No one moves money to protect it during an incoming call. End the call and contact the real institution independently.
7. Cash, gift cards, cryptocurrency, gold, or a courier
A fake bank employee may hand the conversation to a supposed police officer, regulator, or investigator. You may be told to withdraw cash, buy gift cards, use a cryptocurrency machine, purchase gold, wire money, or hand valuables to a courier.
A caller may also tell you to lie to the teller. That instruction is designed to bypass bank staff who might recognize financial exploitation.
Police Scotland warned in 2026 about criminals posing as bank staff or police and telling victims to withdraw cash for collection. Legitimate banks and police do not ask customers to withdraw money for a courier.
Safest response: Do not withdraw, buy, transfer, or meet anyone. Tell a trusted person and contact the bank and police through official channels.
Legitimate versus suspicious bank requests
| Situation | A legitimate bank may | A suspicious caller may |
|---|---|---|
| Unusual transaction | Ask whether you recognize a named payment | Demand a password or code to cancel it |
| Identity check | Use its published verification process | Collect complete credentials and security answers |
| One-time code | Send a code for an action you initiated | Ask you to read the code aloud |
| Account security | Lock a card or account and explain next steps | Tell you to move money to a “safe account” |
| Technical help | Direct you to official support or a branch | Request remote access or screen sharing |
| Customer uncertainty | Allow you to hang up and call back officially | Insist that ending the call will cause a loss |
| Large withdrawal | Ask protective questions about possible fraud | Tell you to lie to the bank employee |
The safest test is whether the request survives an independently initiated call. A genuine concern will still exist when you contact the bank officially. A scam often collapses when the caller loses control.
Simple scripts for ending a suspicious bank call
Prepared words help when a caller is creating fear. The goal is not to win an argument. It is to leave the conversation.
“I do not discuss account security during incoming calls. I will call the number on my card.”
“I never share verification codes. I am ending this call now.”
“I do not transfer money to protect it. I will speak with my bank directly.”
“A genuine bank will allow independent verification. Goodbye.”
After hanging up, do not answer immediate repeat calls. Contact the bank yourself and, where possible, tell another trusted person before taking financial action.
The same habit protects families from fake emergencies. Review the seven warning signs of an AI emergency call and create a family safe word for AI voice scams.
Making the plan practical for aging parents
Older adults are not targeted because they lack intelligence. Bank impersonation scams exploit responsibility, savings, privacy, and the desire to solve a serious problem quickly.
FTC data show impersonators increasingly targeting retirees’ life savings. A family plan should reduce pressure without treating a parent like a child.
Agree on shared rules for everyone:
- No one shares a one-time code with an incoming caller.
- No one moves money to a “safe account.”
- Everyone may end a call, even when the caller sounds official.
- Large or unusual transfers receive a second-person check.
STOP BEFORE SHARING OR SENDING
No password. No PIN. No code. No screen sharing. No “safe account.” Hang up and call the number on the card.
Use large type and two trusted numbers. For hearing loss, never treat voice quality as proof. For memory difficulties, practise: “I will call the bank myself.” Cross-border families should save international bank numbers and identify a nearby trusted contact.
Ask the bank about alerts, card locks, transaction limits, branch support, and other safeguards through an official channel.
Our complete guide on protecting aging parents from AI voice scams and online fraud explains how to build a broader plan without shame or unnecessary loss of independence.
What to do if information was already shared
Act quickly and avoid blame.
- Contact the bank immediately. Explain exactly what was shared, installed, or approved.
- Secure the account. Ask about blocking cards, freezing online access, reviewing payees, and recalling transfers.
- Change compromised passwords. Use a clean device and change the email password if necessary.
- Remove remote-access software. Disconnect the device and seek trusted technical help before banking on it again.
- Preserve evidence. Keep messages, numbers, screenshots, receipts, app names, and transfer details.
- Report the fraud. Use the official service for your country.
- Expect recovery scams. Criminals may promise to retrieve the money for a fee.
If a code was shared but no loss is visible, still contact the bank. It may have approved a device, login, password reset, or payee.
US victims who disclosed identity information can follow the recovery steps at IdentityTheft.gov.
Where to report
| Region | Official reporting route | First action |
|---|---|---|
| United States | FTC ReportFraud and, where appropriate, FBI IC3 | Contact the bank immediately |
| England, Wales, and Northern Ireland | Report Fraud | Tell the bank, then report |
| Scotland | Police Scotland on 101 | Tell the bank, then contact police |
| European Union and wider Europe | Europol’s country reporting directory or local police | Contact the bank immediately |
Call emergency services if there is immediate physical danger. Fraud reporting services are not a substitute for urgent police or medical help.
Family bank-call checklist
Before sharing information or moving money, ask:
- Did I expect this call?
- Am I being asked for a password, PIN, card security code, or verification code?
- Did I personally start the login, payment, device registration, or password reset?
- Am I being told to install an app or share my screen?
- Does the caller want money moved to a new or “safe” account?
- Am I being told to keep the call secret or avoid speaking with family?
- Does the caller object when I say I will hang up and call the bank?
- Am I being told to lie to a teller or withdraw cash for collection?
One unusual request is enough to stop. You do not need proof before protecting the account.
Frequently asked questions
Will a real bank ever call about suspicious activity?
Yes. A bank may call, text, or send an app alert. End an uncertain call and reach the bank through the number on your card, a recent statement, the official app, or a branch.
Can a bank ask security questions on the phone?
Some banks use limited checks, particularly when you initiate the call. Practices vary. An unexpected caller should not collect a full password, PIN, or one-time code. You may end the call and verify independently.
What if the caller knows my balance or recent transactions?
That information does not prove identity. An account, email, device, or statement may be compromised. Contact the bank directly.
Can I approve an app notification to confirm my identity?
Only approve an action you initiated and understand. Never approve a login, payment, device, or payee because an unexpected caller instructs you.
How should I discuss this with an aging parent?
Make the rules mutual. Everyone in the family should hang up, call back officially, and consult another person before an unusual transfer. Focus on the criminal’s method, not the parent’s age.
The bank can wait for a call-back
A bank impersonation scam turns caution into panic. The caller sounds protective, the code arrives from the real bank, and personal details seem to confirm the story.
But real security does not require surrendering the keys to the account.
No full password. No complete PIN. No code for an action you did not initiate. No remote access. No transfer to a “safe account.” No secrecy, cash courier, or lie told to a bank employee.
End the call and create distance. Contact the bank through a channel you chose. Bring another trusted person into the decision.
A genuine fraud concern can survive those steps. A scam depends on stopping you from taking them.
Build the complete family protection plan
My full-color guide, Protect Aging Parents from AI Voice Clones, Fake Bank Calls and Online Scams, includes realistic scenarios, ready-to-use scripts, checklists, emergency-response pages, and a practical 7-Day Family Protection Plan.
Official guidance used in this article
- US Federal Trade Commission: handling unexpected calls claiming your money is at risk
- FDIC: bank impersonation scams and fake banks
- UK Financial Conduct Authority: screen-sharing scams
- Europol: bank vishing and online financial scams
- FTC Data Spotlight: impersonation scams targeting older adults’ life savings
About the author
Michael Onoja is a Microsoft MVP, technology leader, software engineer, researcher, and published author. He writes about AI safety, digital trust, cybersecurity, and practical ways families can protect one another from emerging online threats.
Continue with the guide to recognizing AI emergency-call warning signs, create a family safe word, or read the complete guide to protecting aging parents from AI voice scams.
This article provides general educational information and is not legal, financial, technical, medical, or law-enforcement advice. Bank procedures, reporting services, and recovery options vary, so confirm important steps through your bank and official authorities.