The text arrives at a believable hour from what looks like your bank: “Did you authorize a $950.00 Zelle transfer? Reply NO if this wasn’t you.” You didn’t, so you reply. Two minutes later your phone rings, the caller ID shows your bank’s name, and a calm, professional voice from the “fraud department” offers to help you secure your account. Everything about the experience feels like your bank protecting you. It’s the opposite: the text was the scam, and the helpful voice is the thief.

This is the bank impostor scam, and it isn’t a niche threat. When the Federal Trade Commission analyzed a random sample of scam texts reported to the agency, fake bank fraud warnings were the single most common type — ahead of phony prizes, fake package notices, and bogus job offers — and reports of texts impersonating banks had grown nearly twentyfold since 2019. The money involved is not small either: reported losses to text scams overall hit $330 million in 2022, and by 2024 the figure had climbed to $470 million in reported losses — and since most fraud never gets reported, the true toll runs higher.

Why this one works on smart people

Most scams ask you to be greedy or careless. This one asks you to be responsible. Real banks really do send fraud alerts, so the fake ones borrow a format you’ve been trained to trust. The scam then stacks three pressures: urgency (money is leaving your account right now), authority (the fraud department, with a spoofed caller ID that genuinely displays your bank’s number), and rescue (they’re helping you, so cooperating feels safe).

The endgame varies, but the classic version convinces you your account is compromised and walks you through “protecting” your money — by moving it. You might be told to Zelle yourself, wire funds to a “secure account,” buy gift cards, or read back the one-time passcode that just landed on your phone. That passcode is the scammer logging into your real account; the “safe account” is theirs. As the FTC notes in its scam-text data, these fake bank texts are designed to trigger a response first and thought later — and once you reply or pick up, a skilled social engineer takes it from there.

The tells, in order of reliability

Forget grammar mistakes — modern impostor texts are clean. Focus on behavior, because these tells never change:

Any request to move money “to protect it.” No real bank does this. Ever. Your bank secures a compromised account by freezing cards and reversing transactions, not by having you transfer funds. The FDIC’s consumer guidance on bank impersonation scams is blunt on this point.

Any request for a one-time passcode, PIN, or password. The passcode texted to your phone exists to prove it’s you logging in. The only person who’d ever ask you to read it aloud is someone who is not your bank.

Pressure to act during the call. Real fraud departments document and freeze; they don’t need you to stay on the line while you drive to an ATM or a Bitcoin kiosk.

A link in the text. Banks may send alert texts, but a link demanding you “verify your account” leads to a login-harvesting page. Don’t tap links in unexpected texts, period — the FTC’s guide to spam text messages covers how to spot and report them.

The one habit that defeats it completely

You don’t need to out-argue a professional manipulator. You need one reflex: never respond through the channel that contacted you. Got a fraud text or call? Hang up, don’t reply, and contact the bank yourself — call the number printed on the back of your debit or credit card, or log in through the app you already have installed. If the alert was real, the real fraud department will see it on your account and take it from there. If there’s nothing there, you just watched the scam die of neglect.

This habit works because it removes the scammer’s only real asset: the connection they initiated. Caller ID can be spoofed and texts can be faked, but the number on your card always reaches your actual bank.

If you already replied — or already paid

Replying to the text alone mostly confirms your number is live; expect more attempts, and block and report. If you gave up a passcode or password, call your bank immediately from the card number, lock the account, and change your online banking credentials. If money moved, ask the bank — that same day if possible — whether the transfer can be recalled; speed matters far more than embarrassment. Then report the scam to the FTC at ReportFraud.ftc.gov, forward the text to 7726 (SPAM) so your carrier can trace the sender, and if you’re helping an older relative, say the quiet part warmly: anyone can be gotten by this one, and telling the bank quickly is the move that saves money.

One last reframe for the fridge door: a real fraud alert never needs you to do anything except say “that wasn’t me” to your actual bank. Anything more elaborate — passcodes, transfers, gift cards, staying on the line — is the script of a play in which you’re the mark. Hang up and dial the card.

This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.