The Call From Your Bank: How the Script Works

Someone calls from your bank's fraud department. The number on your screen is your bank's number. They know your name, they may know your address and the last four digits of a card. They are calling because suspicious activity has been detected, and they need to secure your account.

Everything above can be true and the call can still be a fraud, because every element of it is available to buy or fake.

For a practical workplace perspective, Monitask explains mouse jiggler detection software and how it is used.

This scam catches careful people, and it catches them precisely because they are careful. The whole script is built on your wish to protect your money.

Why the details do not prove anything

The number is spoofed. Making a call display any number is trivial and has been for years. The caller ID on your phone is not evidence of anything.

The personal details came from a breach. Name, address, email, phone, employer, the last four digits of a card — this data circulates in bulk. Knowing it proves nothing about who is calling.

The hold music and the menu are real recordings. So is the professional manner.

Impersonation scams remain among the most common forms of fraud, with criminals posing as government agencies, financial institutions or well-known companies and using spoofed phone numbers to make calls appear legitimate.

The script, step by step

It varies in detail and almost never in structure.

1. Establish authority. They name your bank, give an employee number, cite a case reference. All invented and all reassuring.

2. Create alarm. There is a transaction you do not recognise. Someone has tried to add a device. A payment is pending.

3. Establish that they are the good guys. They are calling because they detected it. You are now on the same side, and this is the pivot on which the whole thing turns.

4. Ask you to confirm details. Only to verify identity, of course. This is where information starts moving in the wrong direction.

5. Introduce the urgent action. The money must be moved to a "safe account". A code must be read out. An app must be installed so they can secure the device.

6. Isolate. Stay on the line. Do not hang up. Do not discuss it with staff at the bank branch, because there may be an insider involved. Do not tell family, because the investigation is confidential.

7. Apply pressure. Every minute of delay increases the loss.

Where it always breaks

Three requests appear in every version, and each one is something a real bank will not ask.

"Move your money to a safe account." Banks do not do this. There is no such thing. If your account is compromised, a bank freezes it — it does not ask you to transfer the balance somewhere.

"Read me the code we just sent you." The code exists to prove that you are you. Anyone asking for it is trying to become you. Real messages containing these codes say, in the message itself, that nobody should ever ask for it.

"Install this app so we can help." Remote access software gives the caller your screen and your accounts. No bank asks for it.

Add two more:

"Don't tell anyone, including our branch staff." Isolation is the goal. No genuine investigation requires you to conceal it from the institution running it.

"Buy gift cards / send cryptocurrency / meet a courier." These appear at the end of many versions and are conclusive on their own.

The rule that ends every version

Hang up and call your bank on the number printed on your card.

That is the whole defence, and it works regardless of how convincing the caller was, because it removes the only thing they control — the channel.

Two practical points, because the script anticipates this:

Use a different phone if you can, or wait a couple of minutes before dialling. On some landlines a caller can hold the line open, so redialling reaches them again rather than the bank. Calling from a mobile removes this entirely.

Do not use a number the caller gives you, and do not call back the number that appeared on your screen.

You will not offend anyone. Bank fraud teams expect this, and a genuine one will confirm that hanging up was the right thing to do.

Related versions worth recognising

The same architecture is used by callers claiming to be from other institutions.

The IRS, Social Security and the FBI do not initiate contact with you by calling. Neither does Medicare. Any call claiming to be from them, particularly one threatening arrest, suspended benefits or an unpaid balance, is a fraud regardless of what your screen displays.

Tech support versions begin with a pop-up or a call claiming your device is infected and end with remote access and payment for a problem that never existed.

Utility and delivery versions use the same urgency with a smaller amount, often to establish a payment method they then escalate.

If you have already given something

Act now rather than when you are certain. Nothing is lost by acting on a suspicion that turns out to be unfounded.

Gave a code or password: call the bank on the card number immediately, change the password, and check whether a new device or payee has been added.

Installed software: disconnect the device from the internet, call the bank from a different device, and have the machine checked before using it for anything financial.

Money has moved: call the fraud department immediately. Some transfers can be recalled within a narrow window, and the window is measured in hours.

Report it at reportfraud.ftc.gov and at ic3.gov. The National Elder Fraud Hotline is the AARP Fraud Watch Network.

Two things worth arranging in advance

Know your bank's real number without looking it up. Save it in your phone, from the card, today. In the moment, people search online and reach a number placed there by the people running the scam.

Agree with your family that any call about money gets a callback. Not as a rule for one person — as a household rule. It removes the need to judge, in the moment, whether this particular call is the real one.

The thing worth holding onto

Nobody at a real bank will ever be upset that you hung up to verify. If a caller objects to you doing that, or explains why you must not, you have already learned everything you need to know about the call.

For additional public information on consumer fraud and scam prevention, see Federal Trade Commission.