What bank scammers actually do
Bank account scams work by tricking you into handing over access to your account or money directly. The scammer does not break into your bank's system—they manipulate you into giving them what they need: your login credentials, card details, a wire transfer, or permission to pull money from your account. Once they have that, the money moves out fast, and recovery is slow.
The most common scams follow a few patterns. A scammer texts or calls pretending to be your bank, a payment app, or a trusted company, and creates a false sense of urgency: suspicious activity on your account, a package delivery problem, a tax refund, a job offer, or a romantic connection. They ask you to "verify" information, click a link, download an app, or send money to "secure" your account. By the time you realize what happened, the money is gone or your account is locked in someone else's name.
Key Takeaways
- Scammers use fake texts, calls, emails, and websites to trick you into revealing your password, card number, or bank details—your bank will never ask for these over the phone or text.
- Once a scammer has access to your account or card information, they can drain it within hours, and your bank may not refund you if you sent the money willingly.
- The fastest way to stop an active scam is to call your bank directly using the number on your card or statement, not a number the scammer gave you.
- If you sent money to a scammer, report it to your bank and the Federal Trade Commission immediately; some money can be recovered if you act within hours.
- Passwords, one-time codes, and security questions are never shared with anyone—not your bank, not customer service, not anyone claiming to help you.
How scammers get your login credentials and card details
The most direct route is a fake login page or app. A scammer sends you a link via text, email, or social media that looks like your bank's website or a payment app like Venmo or PayPal. You enter your username and password. The page either logs you in (to seem real) or shows an error, but the scammer now has your credentials. They log into your real account and change the password, lock you out, and move your money.
A variation is the fake customer service call. The scammer calls or texts claiming to be from your bank, Apple, Amazon, or the IRS. They say there is suspicious activity, a security breach, or a problem with your account. They ask you to "verify" your information: full name, date of birth, Social Security number, account number, card number, or PIN. They may even ask you to read back a code they text you—that code is a real login attempt, and by reading it back, you give them access. Your bank will never ask for your password or PIN this way.
Phishing emails work the same way. You receive an email that looks like it came from your bank, with a logo and official language, asking you to click a link and log in because of a security alert or account update. The link takes you to a fake website that copies your bank's design. You log in, thinking you are on the real site. The scammer captures your credentials and uses them immediately.
How scammers move money out of your account
Once a scammer has your login credentials, they log into your account and change the password, email, and phone number on file. You are locked out. They then move money using whatever methods your bank allows: wire transfers, ACH transfers to another bank account they control, or purchases using a debit card they order in your name.
If they have your card number but not your login credentials, they use it to make online purchases or set up recurring charges. They may also add themselves as an authorized user on your account, which takes time but gives them legal access. Some scammers sell your card number to other criminals, who use it for fraud.
The speed matters. Wire transfers and ACH transfers can move money out within hours. By the time your bank notifies you of the transfer, the money is already in another account, often at a different bank or in a different country. Recovering it requires the receiving bank to freeze the account and reverse the transfer—a process that can take weeks or never happen at all.
Why your bank may not refund you
If a scammer tricked you into sending money yourself—via wire transfer, ACH, Zelle, or another payment app—your bank may not refund you. The reason is that you authorized the payment, even though you were deceived. The bank's fraud protection covers unauthorized transactions (someone using your card without permission), not authorized ones you were tricked into making.
There are exceptions. If you report the fraud within a specific window—usually one to three days for wire transfers, longer for ACH—your bank may be able to recall the transfer before it settles. Some banks have scam refund policies that cover certain situations. Zelle and other peer-to-peer apps have started offering limited refunds for authorized transfers made under fraud. But none of these are may provide, and the window to act is narrow.
If a scammer gained unauthorized access to your account and moved money without your permission, your bank is required by federal law to refund you, though they may investigate first. The difference is critical: if you were tricked into authorizing the transfer yourself, you have less protection.
What to do if you think you are being scammed right now
Stop communicating with the person or entity contacting you. Do not click any links they sent, do not download anything, and do not send them money or information.
Call your bank immediately using the phone number on your card or statement—not a number the scammer gave you. Tell them you think you are being scammed and ask them to freeze your account and review recent activity. If you have not sent money yet but the scammer is pressuring you, your bank can confirm whether the threat is real. (It almost never is.)
If you already sent money, tell your bank right away. If it was a wire transfer or ACH, your bank may be able to recall it within hours. If it was a peer-to-peer app like Zelle or Venmo, contact that app's support team immediately. The faster you report it, the better your chances of recovery.
Change your password on any account the scammer may have accessed. Use a strong password—at least 12 characters, with uppercase, lowercase, numbers, and symbols. Do not reuse passwords across accounts.
How to report a scam and recover money
Report the scam to the Federal Trade Commission at reportfraud.ftc.gov. The FTC does not recover money for you, but it tracks scam patterns and shares data with law enforcement. If the scammer is in another country, the FTC may coordinate with international agencies.
Report it to your bank's fraud department in writing. Keep a record of the date, time, and details of the scam, including any messages, emails, or call logs. Your bank will investigate and may file a report with law enforcement.
If you sent money via wire transfer, contact the receiving bank directly. Provide them with the wire details and ask them to freeze the account and reverse the transfer. This works only if the receiving bank cooperates, which is not may provide.
If the scammer used your identity to open a new account or change account settings, place a fraud alert on your credit report by contacting one of the three major credit bureaus: Equifax, Experian, or TransUnion. You only need to contact one; they will notify the others. A fraud alert tells creditors to verify your identity before opening new accounts in your name.
Red flags that separate real bank communication from scams
Your bank will never ask for your password, PIN, full Social Security number, or one-time verification codes via phone, text, or email. If someone asks for these, it is a scam. Period.
Real banks do not create urgency by threatening to close your account or freeze your card unless you act immediately. They do not ask you to click a link in an email or text to log in. They do not call you out of the blue asking you to verify information (though they may call if you reported fraud first).
Real payment apps like Zelle, Venmo, and PayPal do not ask you to send money to "verify" your account or to "test" a transfer. They do not ask for your password via email or text. If someone is asking you to send money to prove something or to secure something, it is a scam.
Scammers often impersonate the IRS, claiming you owe taxes or are owed a refund. The real IRS contacts you by mail first, not by phone or email. They do not demand immediate payment via wire transfer or gift card. If someone claiming to be from the IRS is pressuring you, it is a scam.
Frequently Asked Questions
Can a scammer drain my account if they only have my card number?
They can make purchases and set up recurring charges, but they cannot transfer money out of your account without your login credentials or access to your online banking. However, they can order a replacement card in your name and use that. Report the fraud to your bank immediately so they can cancel the card and freeze the account.
What if I already gave a scammer my password?
Change it immediately from a different device—not the one the scammer may have compromised. Call your bank and tell them your account may have been accessed. Ask them to review recent activity and freeze the account if needed. Enable two-factor authentication if your bank offers it, so future logins require a code sent to your phone.
Can I get my money back if I sent it via Zelle?
Zelle has a scam refund policy, but it does not cover all situations and refunds are not may provide. Report the fraud to Zelle and your bank within one day of sending the money. Zelle may refund you if they determine you were scammed, but the process can take weeks. Do not rely on a refund; act to stop the transfer as soon as you realize the fraud.
What is a one-time code and why should I never share it?
A one-time code is a number your bank texts or emails you to verify your identity during login or a sensitive transaction. It is valid for only a few minutes. If a scammer asks you to read the code back to them or to tell them what it is, they are using it to log into your account. Never share it with anyone, even if they claim to be from your bank.
If a scammer opens a new bank account in my name, am I responsible for it?
No. Report it to the bank immediately and provide proof that you did not open it. File a fraud report with the FTC and place a fraud alert on your credit report. The bank should close the account and remove any fraudulent charges. You may also need to file a police report if the scammer took out loans or credit in your name.