I got a suspicious call or text claiming to be my bank — what should I do?

Short answer: hang up. Don't press any numbers, don't call the number they gave you, and don't click any links. Then contact your bank directly using the phone number on the back of your debit card or the bank's official app.

That one habit — never trusting the incoming contact and always initiating contact yourself — defeats almost every bank impersonation scam. Scammers can spoof caller ID so your phone displays your bank's real name. They can copy your bank's logo and writing style into a text message. What they cannot do is intercept a call or login session that you start yourself through a channel you control.

This article walks through what to do in the moment, how real banks behave differently from scammers, and the recovery steps to take if you already clicked, called back, or shared something before the penny dropped.

Assume the contact is fake until proven otherwise

The uncomfortable truth is that you cannot tell a real bank call from a fake one by listening. Caller ID is trivially spoofed, and modern scam operations buy professional-sounding scripts and voice actors. The same goes for texts: scammers routinely inject fake messages into the same message threads where your bank's genuine texts appear, because carriers cannot always distinguish them.

That is why the starting assumption should be reversed. Treat every unexpected call or text claiming to be your bank as unverified, not as guilty or innocent. You are not being rude by hanging up. You are not overreacting. Banks deal with this every day, and a legitimate fraud department would far rather you call them back on a number you trust than continue a conversation you are unsure about.

The one exception worth noting: if you have just made a large purchase or are traveling and your card gets declined, your bank may genuinely call you. Even then, the safe move is the same. Tell the caller you will ring the number on your card, hang up, and do it. A real agent will respect that.

Hang up, then contact your bank yourself

Here is the exact sequence, and it takes about two minutes.

First, end the call or ignore the text. Do not engage with "press 1 to confirm" menus or reply "STOP" to texts you did not sign up for — in some cases, any response just confirms to the scammer that your number is active.

Second, look up your bank's contact information independently. The number printed on the back of your debit or credit card is the most reliable source. The bank's official mobile app and its website — typed into your browser by you, not reached through a link — are equally good.

Third, call or message the bank and describe what happened. Say: "I received a call claiming to be your fraud department about a suspicious transaction. I hung up and wanted to check whether there is anything actually wrong with my account." They can see immediately whether any real alert exists.

Fourth, while you are in the app, quickly scan your recent transactions for anything you do not recognize. This is good hygiene regardless.

What a real bank will never ask you to do

Knowing the boundaries helps you spot the scam even when the caller sounds convincing. A legitimate bank will not ask you to transfer money to a "safe account" — there is no such thing, and this line is one of the most common and most destructive scam scripts in existence. Money moved to a "safe account" goes to the scammer, and it is almost never recoverable.

A real bank will not ask you to read back a one-time passcode that was just texted to you in order to "verify your identity." Those codes are for you to enter into the bank's own app or website. If you hand the code to a caller, you are effectively handing them the keys to your account. This is how most account-takeover fraud actually happens.

They will not ask for your full card number, your full account password, or your PIN. They may ask you to confirm parts of your identity — your name, your zip code, perhaps the last four digits of your card — but never the complete credentials. And they will not threaten you, create artificial urgency, or tell you to keep the call secret from family members. Pressure and secrecy are the scammer's tools, not the bank's.

Don't click links or call back the number they gave

Scam texts almost always contain a link, and the link is the trap. It leads to a convincing copy of your bank's login page, where anything you type goes straight to the scammer. Sometimes the link instead downloads a file or opens a page designed to harvest a one-time code.

The rule is simple: never log into your bank through a link that arrived by text or email. Always open the app yourself or type the bank's address yourself. Bookmarks are your friend here — save the real login page once and always use it.

The same applies to phone numbers. A scammer who calls you will cheerfully give you a "direct line" to call back, and that line rings at their call center. The only number that counts is the one printed on your card or listed in the bank's app. If you are unsure whether a website is the real one, type it carefully and check for your browser's secure connection indicator — but honestly, the app on your phone is the safest path of all.

What to do if you already engaged with them

First, do not panic, and do not feel embarrassed. These operations are sophisticated, professional, and designed to work on smart people. Shame keeps victims from acting quickly, and speed matters here.

If you clicked a link but entered nothing, you are probably fine, but run a quick check: make sure nothing was downloaded, and do not log into your bank on that device until you are sure it is clean. If you entered login credentials into a fake page, call your bank immediately and tell them exactly what happened. They can reset your credentials, freeze the account, and watch for fraudulent activity.

If you shared a one-time code, call your bank right now — that code may have already been used to authorize a transfer or add a new payee. Ask the bank to review recent activity and, if money moved, whether it can be recalled. If you sent money or cryptocurrency to someone, tell your bank and also report it to law enforcement; recovery is difficult once funds leave, but reporting creates a record and sometimes helps in larger investigations.

Finally, change your online banking password from a clean device, and turn on two-factor authentication if you have not already. Then keep a closer eye on your accounts for the next few months, since your details may have been added to a list that gets sold and reused.

Report the attempt, even if nothing happened

Reporting feels optional, but it is genuinely useful. Banks, carriers, and regulators build their fraud defenses from exactly these reports, and each one sharpens the filters that protect the next person.

Forward suspicious texts to 7726 (which spells SPAM on a phone keypad). This works with most major US carriers and feeds the message directly into their spam-detection systems. You can also report the message to your bank's fraud department — most large banks have a dedicated email address or in-app reporting option for phishing.

For calls, file a report with the Federal Trade Commission at reportfraud.ftc.gov, and consider reporting to the FBI's Internet Crime Complaint Center at ic3.gov. Keep the phone number, the message content, and the time of contact if you have them. You will rarely hear back about an individual report, but the aggregated data is how enforcement actions against scam operations get built.

If the scam impersonated a specific bank, that bank's security team also wants to know — impersonation reports help them issue warnings and take down fake websites faster.

Build habits that make you a harder target

You cannot eliminate scam attempts, but you can shrink the attack surface. Start with your phone's built-in spam filtering and silence-unknown-callers settings; they are imperfect, but they cut down the volume reaching you. Registering your number on the national Do Not Call list will not stop criminals, but it reduces the legitimate-telemarketing noise that teaches you to answer unknown numbers.

Move as much banking communication as possible into the bank's app. Many banks now let you choose push notifications and in-app messages instead of texts and calls for fraud alerts. An alert that appears inside your authenticated banking app is vastly harder to fake than a text message.

Consider a verbal password or additional authentication with your bank if it offers one — some banks let you set a word or phrase that agents must confirm, which makes phone impersonation much harder to pull off. And be careful about how much personal information you share publicly: scammers mine social media for details like your bank's name, your hometown, or your mother's maiden name to make their scripts more convincing.

Why these scams keep working, and what that means for you

Bank impersonation scams persist because they exploit something real: most of us have a genuine, rational fear of losing our money, and the scam converts that fear into urgency. The script is always some variation of "your money is at risk right now, and only immediate action will save it." That manufactured emergency short-circuits the careful thinking you would apply in a calmer moment.

Knowing this does not make you immune, but it does give you a tell. Whenever a financial contact makes you feel panicked, rushed, or afraid to double-check, treat that feeling itself as the warning sign. Real institutions can wait two minutes while you call them back on a trusted number. The scammer's entire business model depends on you not taking those two minutes.

The calm version of you is very hard to scam. Build the habit of pausing now, while nothing is at stake, so it is automatic when something feels urgent. Hang up, verify independently, and never let a stranger's urgency override your own judgment. Your bank will still be there when you call back.