The call from your bank's own number

The story below is a composite. Every element comes from federal enforcement documents and consumer complaints filed with the FCC, cited throughout. No real person is described, and amounts and timings in the story are illustrative.

The text arrives first. Did you authorize a charge of $3,950 at a money transfer service? Reply NO if this wasn't you.

She replies NO. The FTC documents this exact opening: fake fraud alerts were the third most reported text scam of 2024, and people who reply "are connected to the (fake) fraud department" for help with a problem that doesn't exist. The phone rings within a minute, and the number on the screen is her bank's. Not a number that looks like it. The number printed on the back of her debit card, the one she'd call herself.

The man is calm and already knows things. The last four digits of her account. Her address. He says someone inside a payment processor is making transfers out of her account, and the bank has frozen what it can, but the rest has to move somewhere that person can't reach.

He walks her through moving it into a new account in her name. She taps the buttons herself, while he stays on the line to be sure it goes through.

The account isn't hers. That's the FTC's own description of the script, and the part worth underlining: she authorized every transfer.

This isn't hypothetical and the number isn't a coincidence. In April 2026 the FCC proposed a $4.5 million penalty against a phone company that carried tens of thousands of calls into the United States spoofing the fraud reporting numbers on the back of bank cards. Two of the banks were Chase and Bank of America. The case began when a bank complained that its own customers were being called from its own fraud line, and that some of them lost money.

The pattern

This is bank impersonation, and its two halves are worth separating.

The first half is theater, and it's very good theater. A text that asks you to confirm something, so that answering feels like refusing. A callback from a number you'd have dialed yourself. Details about you that a stranger shouldn't have.

The second half is one instruction, and it never changes. Move your money to keep it safe.

The FCC's own consumer alert on this puts the rule as flatly as any federal guidance gets:

Regardless of the pitch, it is always a scam. Banks will never call or text and ask you to move your money to protect it.

Sometimes the destination is a new account. Sometimes it's gold or cryptocurrency, at which point it's become the safe account scam, which is the same machine with more steps.

Why the caller ID was right

Most people assume a spoofed number is a technical failure nobody got around to fixing. The truth is more specific and more useful.

Carriers do sign calls, using a system called STIR/SHAKEN, and it's mandatory for US voice providers. But read what it certifies: that the carrier knows its own paying customer, and that the customer may use the number displayed. It says nothing about who's on the line, or whether a word of it is true. The FCC is only now asking whether carriers should verify caller identity before passing it on. Today they don't have to. The signature is also stripped whenever a call crosses an older network, which the FCC calls the largest obstacle to the whole scheme.

So caller ID matching your bank is not evidence of anything, and most people reasonably assume it is.

The part almost nobody tells you

The law treats money taken from you very differently from money you sent.

If someone steals your login or tricks you into handing over a one-time code, and then makes a transfer, that's an unauthorized transfer. Federal rules cover it and your bank generally has to make you whole.

If you tap send yourself, even while being lied to by a professional impersonating your bank, that's an authorized transfer. It falls outside those protections. The Government Accountability Office says it plainly: where payments were authorized by victims themselves, financial institutions "are not generally required to reimburse victims."

This is not a settled, comfortable area of law, and it's moving:

A 2024 bill to treat induced transfers like unauthorized ones died at the end of that Congress and hasn't come back.
The Consumer Financial Protection Bureau sued Zelle's operator and three large banks in December 2024, then dismissed its own case, with prejudice, in March 2025.
New York's attorney general sued Zelle's operator in August 2025, alleging Zelle users lost more than a billion dollars between 2017 and 2023, New Yorkers among them for millions. That case is live.
Britain went the other way. Since October 2024 UK banks must reimburse these victims up to £85,000. There's no American equivalent.

Here's what that means in practice. A Senate investigation found that at three of the largest US banks in 2023, claims where the customer had been tricked into authorizing the payment were reimbursed about 12 percent of the time. Unauthorized claims, the other category, were reimbursed 38 percent.

So the bank isn't necessarily being unreasonable when it says no. Under current rules it often isn't required to pay. Which is the reason to be certain before you tap send, rather than hopeful afterward.

Where it was visible

The text wanted a reply. Answering is the point. It proves the number is live and starts things on their terms.

They called you. The number was right, but the call still came to you. That sign survives a perfect caller ID.

He knew things about you. Real, and proof of nothing. Names, addresses and partial account numbers circulate after data breaches.

The fix required moving money. A bank protecting your account freezes it. It doesn't ask you to empty it.

He stayed on the line. The FTC is direct about why: it keeps you away from anyone who might see through it.

And the one that's genuinely hard: sending money to yourself doesn't feel like paying anyone. That's why the script uses it. Every instinct about not sending money to strangers is bypassed by an instruction that doesn't look like sending money at all.

What actually stops it

Hang up and call the number on your card yourself. The FCC's advice is exactly this, and it defeats the whole production, because the spoofed number only works in the direction they control.

Never reply to a fraud alert text. Open your banking app instead. A real problem is visible there.

Treat "move your money" as the end of the conversation. Not a question to ask about. The answer is already known.

Never read out a verification code. The FTC is absolute: no caller, and especially nobody from your bank's fraud department, will ever ask for one.

Know that a genuine fraud department will wait. They'll be glad you hung up to check. Anyone who objects to you calling back has told you what they are.

The five signs, in this case

The five signs all appear, with the first one disguised.

It came to you. The spoofed number attacks precisely this sign, which is why it's worth naming: the call still came to you, whatever the screen said.

It moved you fast. A transfer in progress is about the most urgent thing a person can be told.

It wants a transfer. Literally. This is the only pattern on this site where the scam and the sign are the same action.

It wants it kept quiet only loosely here, which is worth noticing. Not every scam needs secrecy when it is fast enough.

It keeps you on the line. He stays with you while you tap the buttons, to be sure it goes through.

The first two steps are the whole defense here. Break the contact, then look up the number yourself, or use the one on your card. Nothing in this scam survives it.

How common is it

Bank impersonation is the most expensive kind of impersonation scam in the country.

In 2025 people reported losing about $1 billion to businesses being impersonated, and the FTC says bank impersonators took the largest share. Imposter scams overall came to $3.5 billion, close to one fraud report in three.

For older adults the phone is the dangerous channel. In 2024 the median loss for fraud arriving by phone was $2,210 for people 60 and older, against $650 for fraud starting on social media. Fewer incidents, far larger losses.

Tell one person

Send this to a parent and ask them one question: if your bank texted about a fraudulent charge, what's the first thing you'd do?

If the answer is "reply," you've found the gap, and it closes with one sentence: hang up and dial the number on the back of the card.

The sentence worth remembering: your bank will never ask you to move your money to keep it safe.

When the story starts with a frozen screen instead of a text, it's the tech support chain. When the caller claims to be from a government agency rather than a bank, it's government impersonation, and the instruction at the end is the same one.

If this happened to you, or to someone you love

You're not the first and you did nothing stupid. The number really did match, and the system that's supposed to make numbers trustworthy was never designed to tell you who's calling.

Call your bank now, on the number on your card, and use the word "fraud". Ask them to attempt a recall and to freeze the receiving account. Speed matters more than having the full story.
Ask specifically whether the transfer was authorized or unauthorized, and say exactly what happened. If someone else made the transfer using your credentials or a code they tricked out of you, that's unauthorized, and the protections are much stronger. This distinction decides the outcome, so describe the events precisely rather than summarizing.
If the bank declines, ask for that in writing, then file with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint and with your state attorney general.
Report it at ic3.gov and reportfraud.ftc.gov. Reporting fast is what makes a freeze possible.
Call the National Elder Fraud Hotline, 833-372-8311, Monday to Friday, 10 a.m. to 6 p.m. Eastern.
Change the password on your email account first, before the banking one. It can reset everything else.

Anyone who contacts you afterward offering to recover the money for a fee is the next scam, and this pattern is followed by one unusually often.

Verify first.

Sources last checked: 15 September 2026.