Bank Impersonation Scam: Warning Signs, Consumer Rights, and the Fastest Practical Next Steps

The First 10 Minutes: What to Do Right Now

Read this section first, even if you are not sure the call is a bank impersonation scam. Each step takes a minute or two. The order matters because the first goal is to stop more money from leaving, and the second is to start the clock on your protections.

Steps 1 and 2: Stop the Call and End Any Remote Session

Step 1. Stop. Hang up. Do not “stay on the line while you check.” The caller’s main tool is time pressure, and you take it away by ending the call.

Step 2. End the session. If the caller asked you to install an app or share your screen, close it now. If you are unsure how, turn the device off. A scammer who can see your screen can see your banking login.

Do not press keys, text a reply, or tap a link in any message the caller sent. Do not read out a verification code, even to someone who says they are from your bank. The FTC’s rule of thumb is blunt: never share a verification code with someone you did not contact first.

Steps 3 and 4: Reach the Real Bank and Lock Things Down

Step 3. Call the real bank. Use the number on the back of your debit or credit card, on a paper statement, or inside your own banking app. If the scammer’s call reached your phone, use a different phone when you can.

Step 4. Tell the bank what happened, in plain words. Say which accounts and cards are involved. Say what moved, how it moved (Zelle, wire, card, crypto machine), the amounts, and the times. Then ask for four things:

1. Stop or flag any pending transfers.
2. Request a recall or return for any payment already sent.
3. Lock or replace the affected cards and change the account numbers if needed.
4. Open a fraud claim, and give you a claim or reference number.

Write down the representative’s name, the time, and the reference number. You will need them later.

Steps 5 and 6: Change Credentials and Report It

Step 5. Change your passwords from a clean device. Start with online banking, then email, because email resets the rest. If you shared access to your computer, update your security software and run a scan, as the FTC advises in its guide on what to do if you were scammed.

Step 6. Report it. File at ReportFraud.ftc.gov. If money left your account, also file at ic3.gov, the FBI’s Internet Crime Complaint Center. Reporting does not get your money back by itself, but it creates a record and feeds law enforcement data.

Ending the call is a complete first step. You lose nothing by hanging up and calling your bank back on a number you trust.

How the money left decides your rights. Transfers a scammer made with your credentials are unauthorized under federal rules. Payments you sent yourself are treated differently.

Debit and bank-account protections run on short clocks. Reporting within two business days caps your loss at $50 in the standard tier. Reporting within 60 days of the statement is the outer limit.

Credit cards give the strongest recourse. Your liability for unauthorized use is capped at $50, and you can dispute billing errors without paying the disputed amount.

Wires, crypto machines and gift cards rarely come back. Report within minutes, because speed is the only lever you have.

Report, then repair. File with the FTC and FBI, freeze your credit if personal data was exposed, and secure your accounts and phone number.

The Numbers and Deadlines Behind a Bank Impersonation Scam Claim

Deadlines in this area are short, and they come from different places. Some are federal regulations. Others are bank or network policies. The table below separates them, so you know which clock you are racing.

The pattern in this table is the point. The firm federal deadlines sit on the unauthorized transfer side. For payments you sent yourself, there is no federal clock and no guaranteed refund. That gap is why the next sections spend so much time on classification.

How a Bank Impersonation Scam Actually Works

This section describes the pattern, not a playbook. Knowing the shape of the con helps you spot it mid-call, when a clear head is hardest to find. The details change from one crew to the next. The structure rarely does.

The Core Move: A Believable Emergency With a “Safe” Exit

Every bank impersonation scam has two parts. First, a problem that sounds urgent and specific: suspicious charges, a login from another state, a compromised card. Second, a solution that conveniently requires you to act. The solution usually involves moving money, sharing a code, or letting someone onto your device.

The FTC describes the common thread in its 2026 analysis of 2025 data. Some of the costliest impersonation scams, it says, start with a fake security alert, often from a bank, and people are convinced to move money to “protect” it. The logic is backwards. Your bank protects money by blocking and reversing transactions inside its own systems. It does not need you to send funds anywhere.

Notice what the story does to your options. If you believe your account is under attack, hanging up feels risky and complying feels safe. The script is built so that the dangerous choice feels like the careful one.

Four Ways the First Contact Arrives

The opening move of a bank impersonation scam varies by channel. The destination is the same: a phone call or a form that gets you to hand over credentials, codes, or money.

The text channel deserves a note. The FTC’s data spotlight on 2024 text scams found that fake fraud alerts were the third most reported text-scam type. Those texts often look like they come from a bank or Amazon and may ask you to reply YES or NO about a large charge. Total reported losses to text scams in 2024 were $470 million, more than five times the 2020 figure.

Why Caller ID and “Verification” Prove Nothing

Caller ID can be faked. The FCC explains that spoofing means a caller deliberately falsifies the information shown on your display, and it advises hanging up on unexpected callers and calling back an official number. A familiar name on your screen is a coincidence of software, not proof of identity.

Scammers also borrow the vocabulary of security. They may ask you to “verify” your identity by reading a code that your bank just texted. Reading that code aloud can hand them what they need to get into your account.

The CFPB’s own examples describe this tactic precisely. In its Regulation E FAQs, the agency lists a caller who pretends to be from your financial institution and tricks you into providing your login information, a texted account confirmation code, or your debit card number. That is the pattern in the wild.

Remote Access and the “Phantom Hacker” Variation

Some bank impersonation scams add a technical layer. The FBI’s Internet Crime Complaint Center described a three-stage version in a September 2023 public service announcement. The first contact poses as tech support and asks you to install remote-access software. The second poses as your bank or brokerage, claims your accounts were breached, and urges you to move money to a “safe” account. The third poses as a government employee and keeps the pressure going.

The numbers in that alert are dated but instructive. For January through June 2023, the IC3 received about 19,000 tech support scam complaints with $542 million in losses. Nearly half the victims were over 60, and they accounted for 66% of the losses.

The practical lesson is simple. Remote-access software gives the other side a live view of your screen. If you ever approved it, treat the device and every password you typed as exposed.

Why Careful People Still Get Caught

A bank impersonation scam works on routine, not ignorance. Three ordinary instincts do the damage.

• Authority. A caller who sounds like a bank professional triggers deference.
• Loss aversion. The threat is losing money you already have, which feels sharper than any gain.
• Narrowing attention. Under time pressure, people stop checking and start following steps.

None of this is a character flaw. Professional crews rehearse these calls and refine them against what works. Treating a loss as a failure of intelligence adds shame to the financial harm, and shame keeps people from reporting quickly. Speed is where recovery lives, so this guide treats reporting as a skill to practice, not a confession.

Warning Signs, Ranked by How Fast They Cost You Money

Not every warning sign of a bank impersonation scam carries the same weight. Some signal a nuisance. Others signal that irreversible money is about to move. Sort what you see by two questions: how urgent is it, and can the damage be undone?

Stop-Now Red Flags

Any one of these is enough to hang up or close the message. You do not need a second sign.

• Someone asks you to move money to a “safe,” “temporary,” or “protected” account.
• Someone asks you to read out a code sent to your phone or email.
• Someone asks you to install an app or share your screen.
• Someone tells you to buy cryptocurrency, gift cards, or a cashier’s check, or to feed cash into a machine.
• Someone tells you not to tell bank staff, family, or anyone else why you are moving money.
• Someone insists you stay on the line while you act.

The last two matter more than they look. Secrecy and line-holding exist to stop the single thing that breaks the spell: a second opinion. The FTC’s four-sign test for any scam fits here. Scammers pretend to be from an organization you know, describe a problem, pressure you to act now, and tell you to pay in a specific way.

Red Flags in Order of Urgency and Reversibility

The table ranks common signals. “Reversibility” means how likely the harm can be undone if you act on the signal and then realize the truth.

Notice that the most urgent rows describe what you are asked to do, not how the message looks. Polished scams pass every appearance test. They fail the behavior test.

Weaker Signals That Still Deserve a Second Look

Some clues are only suggestive. A text from an unfamiliar number is one. A link whose address does not match the bank’s site is another. A greeting that does not use your name is a third, though many real alerts also skip it.

Use these as prompts, not verdicts. If a message feels off but you cannot say why, verify through a channel you control. Open the banking app. Call the number on your card. The cost of checking is a few minutes.

What a Genuine Bank Contact Looks Like

Banks do contact customers about suspicious activity. A real alert often asks you to confirm or deny a specific recent transaction. What it does not need is the secret half of your login.

Use this practical test, which reflects the FTC and CFPB guidance above rather than any one bank’s policy. A genuine fraud team can work entirely inside the bank’s systems. It can block cards, flag transactions, and reverse errors without your help. So a caller who needs you to do something outside the bank is describing a task the bank has no reason to assign.

Policies differ across institutions, so this is a rule of thumb, not a law. When in doubt, hang up and call back.

Your Rights Depend on How the Money Left Your Account

Consumer rights after a bank impersonation scam are not one rule. They are several overlapping systems: federal regulations, state law, payment-network rules, and your bank’s own policy. Which one governs your loss depends on the payment type and on one deceptively simple question.

The First Question: Who Started the Transfer?

Federal rules draw a sharp line. Under Regulation E, an unauthorized electronic fund transfer is one initiated by a person other than you, without actual authority to do so, and from which you receive no benefit. The CFPB’s interpretation adds that a transfer is also unauthorized when someone obtained your access device from you through fraud or robbery.

If a scammer, using your stolen login or card details, moves money, that is the unauthorized category. If you open your app and send the money yourself because a caller told you to, banks generally treat that as authorized, even though you were deceived. Zelle’s own materials use that framing. They describe reimbursement for “certain qualifying imposter scams where the customer authorized the transaction.”

Many real cases mix both categories. A caller gets your code, then talks you into approving a payment. When facts blur, say everything to your bank and ask it to decide each transfer separately, in writing.

Debit Cards and Bank-Account Transfers Under Regulation E

Regulation E implements the Electronic Fund Transfer Act. It covers electronic transfers to or from a consumer’s account, including debit card purchases, ATM transactions, and many online and phone-initiated transfers. It excludes checks and wire transfers, which follow other rules.

For unauthorized transfers, your maximum liability depends mainly on how fast you report:

• Within two business days of learning of the loss or theft: the lesser of $50 or the amount taken before you told the bank.
• After two business days: up to $500, built from the first $50 plus transfers after the two-day mark and before notice.
• After the statement window: if you do not report within 60 days of the statement that shows the transfer, you can be liable for later unauthorized transfers.

The tiers are written around the loss or theft of an access device. Banks and customers can disagree about how they apply to stolen login details. Reporting fast is the safe choice either way.

Extenuating circumstances can extend the deadlines. The regulation tells banks to extend the time to a reasonable period if something like a long hospital stay prevented you from reporting. You can report in person, by phone, or in writing.

When the Scammer Used Your Login, Codes, or Card Details

This is the situation the CFPB addressed directly. In its Regulation E FAQs, the agency says that when a third party fraudulently induces a consumer to share account access information and uses it to initiate a transfer, the transfer is unauthorized under Regulation E. The examples include a caller impersonating the consumer’s financial institution to obtain login information, a texted confirmation code, or a debit card number.

Four related points from the same FAQs matter in a dispute:

• Negligence does not shift liability. A bank cannot use your carelessness to impose greater liability than Regulation E permits.
• Network finality does not override the law. Private rules saying a transfer is final and irrevocable do not reduce your protections for unauthorized transfers.
• Giving credentials to a scammer is not “furnishing” an access device. The FAQs say a consumer fraudulently induced to provide account information has not furnished an access device, so the bank cannot call the transfers authorized on that ground.
• Your account agreement cannot waive the law. The statute bars agreements that waive rights it confers, and the FAQs apply that bar to contract language about sharing account information.

Treat the FAQs as the agency’s reading of the regulation, not as a statute. The regulation itself is binding. The FAQs were last modified in January 2025 and were still posted without a withdrawal notice when this article was checked in October 2026.

When You Pressed Send Yourself

If you initiated the payment, Regulation E’s unauthorized-transfer protections generally do not apply on their face. Your path runs through the payment network’s policy, your bank’s discretion, and complaint channels.

For Zelle, the picture has three parts. Zelle says money goes directly into the recipient’s bank account and urges users to treat it like cash. Zelle also says it requires reimbursement for certain qualifying imposter scams where the customer authorized the transaction. And its guidance tells victims to contact their own bank or credit union first, because qualifying scams “may be eligible for reimbursement.”

Two caveats follow. The published pages do not define “qualifying,” so eligibility details sit in network rules and your bank’s terms. Ask your bank which criteria it applied. Second, the outcomes data is limited and dated.

The CFPB sued Zelle’s operator and three large banks in December 2024. The Bureau voluntarily dismissed the case in March 2025, and the court dismissed it the next day. No court ruled on the merits. That means the question of how far the law requires banks to reimburse authorized-but-induced payments remains open, not settled.

Credit Cards: The Strongest Protection

After a bank impersonation scam, credit cards sit at the top of the protection ladder. Under Regulation Z, your liability for unauthorized use is capped at the lesser of $50 or the value obtained before you notify the issuer. Often it is $0.

You also have billing-error rights. You must send a written notice to the creditor’s designated address no later than 60 days after the first statement that shows the error. The creditor must acknowledge within 30 days and resolve the matter within two billing cycles, and in no event later than 90 days. While the dispute is pending, you need not pay the disputed amount, and the creditor may not try to collect it. Your card issuer’s app may offer a faster dispute form, but the written notice protects your rights.

For deeper coverage of card-specific cases, see our guide to credit card fraud and the companion piece on debit card fraud.

Wires, Crypto Machines, Gift Cards, and Cashier’s Checks

These are the hardest rails to unwind. Wires are generally outside Regulation E and governed by Article 4A of the Uniform Commercial Code, which states adopt. Under that framework, a bank often does not have to reimburse a wire you authorized.

In 2024, the CFPB took the position in court that some consumer wires count as electronic fund transfers. It moved to withdraw that statement on March 25, 2025, so the traditional view stands. The FTC says of wiring money that “once you send it, you usually can’t get it back.”

Cryptocurrency payments generally cannot be reversed, according to the FTC. Gift card issuers sometimes help if you contact them quickly. For a cashier’s check or money order, ask the issuing bank at once whether a stop or recall is possible. Policies vary.

The table above explains why the same loss can have very different outcomes. Two victims who lost the same amount to the same story can land on opposite sides of the line. One paid by credit card. The other paid by wire.

Rules and Exceptions at a Glance

This table keeps the legal sources and the exceptions in one place, so you can tell what is law and what is policy.

Five Illustrative Scenarios: How the Rules Play Out

The following examples show how a bank impersonation scam can unfold. They are illustrative. They use made-up people and round numbers to show how the rules above interact. They are not real cases, and outcomes in real disputes depend on facts, bank policy, and sometimes state law.

Scenario 1: A Texted Code and a Same-Day Report

Scenario 2: Waiting a Week to Report

Scenario 3: A Zelle Payment to a “Safe Account”

Scenario 4: A Wire for $15,000

Scenario 5: Charges on a Credit Card

What the Five Scenarios Show Side by Side

Look at the exposure column. The scenarios share one lesson. The faster you report, the more rules and recall options remain available. The payment type then sets the ceiling.

Which Move Fits: A Decision Framework for Wait, Call, Dispute, or Escalate

Use this decision framework when you are not sure what level of response a situation needs. Start at the top and stop at the first rule that fits.

1. Call the bank now if money moved, or if you shared a code, a password, card details, or device access. There is no scenario where waiting helps. Ask for the fraud department and a reference number.
2. Verify, do not engage, if you only received a message. If you did not click, reply, or share anything, open your banking app directly and look for alerts. Forward scam texts to 7726 and report to ReportFraud.ftc.gov. You do not need a dispute, because no transfer occurred.
3. Dispute in writing if the bank does not act. For debit and account transfers, send written confirmation within 10 business days of an oral report if the bank asks. For credit cards, send the billing-error notice within 60 days.
4. Escalate when the answer is no, late, or unexplained. Ask for the written findings the regulation requires if the bank decides no error occurred. Then take the next step on the ladder below.

The escalation ladder, in order:

1. A supervisor or the fraud department’s dispute team at the bank.
2. A written complaint to the bank, which creates a record.
3. A complaint to the CFPB, the bank’s primary regulator, and your state attorney general or banking department.
4. For large losses, a consultation with a consumer attorney or a legal aid office.

Escalation does not guarantee a reversal. It does create a paper trail, and complaints also feed regulators’ data.

What Happens After You Report: A Realistic Timeline

Once you report an unauthorized transfer, the bank’s clock starts. Knowing the stages helps you tell a normal wait from a missed deadline. The timeline below follows Regulation E for debit and account transfers, with credit card and complaint timelines alongside.

Two details deserve emphasis. The 20-business-day and 90-day extensions apply to newly opened accounts, point-of-sale debit card transactions, and some out-of-state or foreign transfers. And a provisional credit is a bridge, not a verdict. The bank can reverse it if it finds no error, but only with notice.

If the Bank Says the Transfer Was Authorized

A denial should come in writing. Under Regulation E, a bank that finds no error must give a written explanation of its findings and note your right to request the documents it relied on. Ask for them. If the bank takes back a provisional credit, it must tell you the date and amount, and it must honor certain payments to third parties for five business days after the notice without overdraft charges.

Compare the bank’s reasoning against what you actually did. Did you read out a code, share a login, or approve a device? The CFPB treats transfers made with credentials obtained by fraud as unauthorized. If the denial depends on a fact you dispute, say so in writing and escalate.

Why a Slow Answer Is Not Always a Violation

Banks sometimes ask for more information, and the investigation can legally run 45 or 90 days. What the regulation requires is the provisional credit when the 10-business-day deadline passes, with the limited exceptions noted. If the bank is silent past its deadline, send a written reminder that cites the date of your report. Then file a complaint.

The Evidence to Gather and Keep

Good records speed up any bank impersonation scam claim. They also protect you if the facts are later disputed. Start gathering while memories are fresh, but never call a scammer back to collect evidence.

Create one folder, digital or paper, and keep everything in it. Write a short timeline in plain language: when the contact began, what you were told, what you did, and when you reported. Dates and times beat summaries.

Where to Report, and What Each Report Does

Reporting a bank impersonation scam reaches different agencies, and none of them can promise a refund. Reporting still matters. It builds the record that regulators, banks, and law enforcement draw on.

The CFPB’s complaint page said in October 2026 that it was accepting complaints. The agency’s priorities and resources have shifted since 2025, so treat it as one channel among several. A complaint to your state regulator or attorney general can reach the same bank from a different direction.

Repair the Damage: Secure Your Accounts, Phone, and Credit

After a bank impersonation scam, stopping the loss is step one. Step two is closing every door the scammer may still hold. Work through these in order, from a device you trust.

Reset the Keys: Passwords and Sign-In Methods

Change your online banking password first, then your email password. Email matters because most “forgot password” links land there. Use a unique password for each. If you reused the old one anywhere else, change it there too.

Upgrade your sign-in method if your bank offers options. The FTC explains that text-message codes can be intercepted if someone takes over your number through a SIM card swap. Authenticator apps are safer, and physical security keys are the strongest method it describes. Do not share any code with someone who contacted you first.

Protect Your Phone Number

If a scammer had your device or your carrier login, check your mobile account. Look for added users, forwarding settings, or unfamiliar devices. Ask your carrier what extra protections it offers on your account, such as a PIN for changes. Terms vary by carrier. Our guide to the SIM swap scam covers the number-takeover pattern in more detail.

Freeze Your Credit if Personal Data Was Exposed

A credit freeze stops most new accounts from being opened in your name. The FTC says freezes are free, and you place them with each of the three credit bureaus. A fraud alert is lighter. An initial alert lasts one year, and the bureau you contact tells the other two. An extended alert lasts seven years and requires an FTC identity theft report.

If you shared your Social Security number, a driver’s license image, or full account details, freezing is the better choice. If you only shared a code that has since expired, you may not need it. Read more in our guides to a credit freeze and a fraud alert.

The CFPB’s company listing says ChexSystems, which collects checking-account history, will freeze your report on request. Confirm the current terms with ChexSystems before relying on it.

Check Your Accounts and Linked Services

Look for new payees, new linked devices, changed contact information, and any alert settings that were turned off. Ask your bank whether to change account numbers and replace cards. Review statements for the next 60 days, since each statement starts the clock for reporting new problems.

If a scammer controlled your device, consider a full reset. Then restore only what you need.

When Personal Information Was Shared

IdentityTheft.gov builds a personal recovery plan after you report. Our guides on identity theft and identity theft recovery walk through the longer process. If a scammer gained control of your accounts, the account takeover guide covers the specific steps.

Recovery Realism: When Money Comes Back and When It Does Not

You deserve a straight answer about recovery from a bank impersonation scam. Some losses are reversed quickly. Many are not. The difference usually comes down to the payment type, the speed of your report, and who initiated the transfer.

What Improves Your Odds

Five factors move the needle:

• Reporting within minutes or hours, when funds may still be sitting in the receiving account.
• Precise facts, including the amounts, times, and payment channel.
• Correct classification, because a transfer made with your stolen credentials sits in a different legal category from one you sent yourself.
• Written notices, which trigger the deadlines in your favor.
• Escalation after a denial, since a first answer is not always the final one.

What the Data Shows About Payment Paths

The FTC’s August 2025 analysis of large losses reported by older adults in 2024 shows where money tends to go. Cryptocurrency, mostly through Bitcoin ATMs, accounted for 33% of reports. Bank transfers were 20%, and cash was 16%. Those channels share a feature: once the money lands, reversal is difficult.

The FBI’s 2025 report counted 13,460 cryptocurrency ATM and kiosk complaints with $389 million in losses. Dividing one by the other gives an average of roughly $28,900 per complaint. That figure is Banktimer’s arithmetic on IC3’s totals, and averages hide a wide range.

When the Money Is Probably Gone

If you paid through a crypto machine, mailed cash, or sent gift card numbers long ago, recovery is unlikely. Say so to yourself plainly, then move to what still helps. Report the scam. Secure your accounts. Freeze your credit if data was exposed. And ignore anyone who offers to recover the money for a fee.

This is also the moment to talk to someone. Losses are hard on people for reasons beyond the dollar amount. A family member, a trusted friend, or a legal aid office can help you think clearly. If you are 60 or older, the DOJ Elder Justice Hotline at 1-833-372-8311 is listed in a 2026 FBI alert.

Current Context (as of October 2026)

Several developments shape what you can expect from a bank impersonation scam claim right now. They change the odds at the margins, not the basic structure of your protections.

• Reported losses are at record highs. The FTC reported in June 2026 that about $16 billion was lost to fraud in 2025, up roughly 25% from 2024. Imposter scams accounted for $3.5 billion, and nearly one in three fraud reports involved an imposter. Bank impersonators had the highest reported losses among business impersonators.
• The FBI’s count is larger. Its 2025 report logged 1,008,597 complaints and $20.877 billion in losses. Government impersonation drew 32,424 complaints and about $798 million.
• The Zelle lawsuit ended without a ruling. The CFPB’s December 2024 case against Zelle’s operator and three banks was dismissed in March 2025 after the Bureau dropped it.
• Federal wire guidance reversed. The CFPB withdrew its position that consumer wires are electronic fund transfers.
• The CFPB trimmed its guidance. It withdrew 67 guidance documents in May 2025. The Regulation E FAQs cited here were still posted in October 2026, but guidance can change. The regulation itself is what binds banks.
• The FTC is looking at platforms. The Impersonation Rule took effect April 1, 2024. In late September 2026, the FTC issued an advance notice asking whether to add rules aimed at how platforms’ ad tools can further impersonation scams. That could curb scam ads, but it does not change your refund rights.

The practical takeaway: the old protections still do the heavy lifting, and speed is still the variable you control.

Common Mistakes That Raise Your Losses

Most expensive errors in a bank impersonation scam come from good instincts applied in the wrong place. Watch for these.

• Staying on the line “to check.” It gives the scammer time to finish.
• Calling back a number from the text or the caller. It leads right back to the scam.
• Waiting to see if the charge clears. Time is the main cost under the tiered rule.
• Describing the event vaguely. Say what you were told, what you shared, and what you did. Let the bank classify it.
• Skipping the written follow-up. The 10-business-day written confirmation can affect your provisional credit.
• Missing the 60-day statement window. Read each statement as soon as it arrives.
• Securing the bank login but not the email account. Email is the master key.
• Paying a “recovery” service. The FBI warned in July 2026 that impersonators target past victims with recovery offers.
• Assuming no one can help because you “sent it yourself.” Some banks reimburse qualifying imposter scams, and you can always escalate.

Protecting Yourself and Your Family Before the Next Call

You cannot stop a bank impersonation scam call from arriving. You can make the call fail. These habits work because they remove the decision from the moment of maximum pressure.

Habits That Make the Call Fail

• Own the callback. Any call about money ends, and you place the next call yourself, using the number on your card.
• Save the real number. Put your bank’s fraud line in your contacts from the back of your card.
• Prefer authenticator apps or security keys to text-message codes when your bank offers them.
• Turn on transaction alerts, so a transfer you did not make reaches you in minutes. Alerts also help you meet the 60-day window.
• Ask about limits. Some banks let you set transfer limits or require extra confirmation for new payees. Terms vary.
• Use call-blocking tools, as the FTC recommends.

Helping an Older Relative

Large losses are a particular pattern for older adults. The FTC found that reports of losses over $100,000 rose nearly sevenfold between 2020 and 2024 among older adults. The FBI’s September 2023 phantom hacker alert found people over 60 were nearly half of victims and 66% of losses in the period it covered. A calm conversation beats a lecture. Agree on one rule: any request to move money gets a second voice, ideally a family member, before anything is sent.

Our guides on elder financial abuse, bank phishing texts, payment app scams, Zelle scam recovery, and wire transfer scams go deeper on each channel.

Frequently Asked Questions

What should I do if I have a bank impersonation scam problem?

Hang up, then call your bank on the number printed on your card or statement. Tell the bank what moved, how, and when, and ask for a fraud claim and a reference number. Then change your passwords from a clean device, report to ReportFraud.ftc.gov, and file at ic3.gov if money left your account.

Do these in order and in minutes, not days. The first call decides how many of your options stay open.

Will my bank refund money if I sent it myself?

Not automatically. Regulation E’s unauthorized-transfer protections generally apply when someone else initiated the transfer. If you sent the payment, your outcome depends on the payment type and the bank’s or network’s policy.

Zelle says it requires reimbursement for certain qualifying imposter scams where the customer authorized the payment. The criteria are not published on its pages, so ask your bank for the written criteria it used.

How long do I have to report an unauthorized transfer?

Report within two business days to hold your loss to $50 under the tiered rule, and no later than 60 days after the statement that shows the transfer. Waiting longer can expose you to larger losses, including later transfers.

The regulation lets banks extend the time if something like a long hospital stay prevented you from reporting. Do not rely on that. Report as soon as you notice.

Can my bank refuse because I gave the scammer a code?

Not on that ground alone, according to the CFPB. The agency says that when a consumer is fraudulently induced to share account access information and a third party uses it to initiate a transfer, the transfer is unauthorized under Regulation E.

The CFPB’s FAQs also say a bank cannot rely on your negligence to impose greater liability than the regulation allows. Banks can still dispute the facts, so describe exactly what you shared and when.

Does Zelle reimburse imposter scams?

Sometimes. Zelle says participating institutions are required to reimburse customers for certain qualifying imposter scams where the customer authorized the transaction. The word “qualifying” matters, and the details sit in network rules and your bank’s terms.

Report to your bank first. Zelle’s own guidance tells victims to contact their bank or credit union, because qualifying scams “may be eligible for reimbursement.”

Can a wire transfer be reversed?

Possibly, but rarely, and only if you act within minutes or hours. Wires are generally outside Regulation E. Your bank can ask the receiving bank to return the funds, and success depends on whether the money is still there.

The FBI’s Recovery Asset Team froze about $679 million of $1.16 billion in attempted theft in 2025 across 3,900 referred incidents. Treat that as proof the process works sometimes, not as a promise.

Should I freeze my credit after a bank impersonation scam?

Yes, if you shared personal information such as your Social Security number, ID details, or full account data. A freeze is free and blocks most new credit accounts. You place it with each of the three credit bureaus.

If you only shared a one-time code and nothing else, a fraud alert may be enough. Read more about when each fits in our guide to identity theft.

How can I tell if a call from my bank is real?

You cannot tell from the call itself, because caller ID can be faked. End the call and phone the number on your card. If the bank really has a concern, it will have a record of the alert, and the fraud team can talk to you then.

A caller who needs you to move money, read a code, or install software is describing a task outside the bank’s systems. That is your signal to stop.

Will reporting to the FTC or FBI get my money back?

Not by itself. Reports build national fraud data and may be referred to law enforcement. The IC3 says it cannot respond to every complaint it receives.

Report anyway. A report number supports your bank claim, identity-theft recovery steps, and complaints to regulators.

What if the victim is an older relative?

Take the same first steps: stop contact, call the bank on a trusted number, and report. Stay calm and avoid blame, because shame delays reports. For people 60 and older, the DOJ Elder Justice Hotline at 1-833-372-8311 is listed in an FBI alert.

Beyond the immediate response, set up transaction alerts and agree on a rule that any request to move money gets a second voice before anything is sent.

Methodology

This article draws on primary sources: the text of 12 CFR Parts 1005 and 1026 on the eCFR, CFPB guidance and enforcement pages, FTC consumer advice and 2025 data, FBI Internet Crime Complaint Center reports, and Zelle’s published pages. Secondary sources, including a Senate subcommittee staff report as summarized by its chair and law-firm summaries of the CFPB’s wire position, supply context only. All sources were checked on October 6, 2026.

Scenarios and calculations are illustrative. They use round numbers and made-up people, and they do not represent real cases or current market data. Derived averages are Banktimer’s arithmetic on published totals. Rules vary by account type, payment type, state law, and the terms of your bank or network. Facts such as statistics and agency positions can change. Banktimer is not a law firm or a financial advisor, and this article does not provide legal or personalized financial advice. If you need advice on a specific loss, consult your bank’s fraud team, a consumer attorney, or a legal aid office.

Sources

Primary official sources:

• 12 CFR 1005.3, Coverage (eCFR)
• 12 CFR 1005.6, Liability of consumer for unauthorized transfers (eCFR)
• 12 CFR 1005.11, Procedures for resolving errors (eCFR)
• 12 CFR 1026.12, Special credit card provisions (eCFR)
• 12 CFR 1026.13, Billing error resolution (eCFR)
• CFPB, Electronic Fund Transfers FAQs (last modified January 16, 2025)
• CFPB, Enforcement action: Early Warning Services, Bank of America, JPMorgan Chase, Wells Fargo
• CFPB, Submit a complaint
• FTC, What To Do if You Were Scammed
• FTC, Credit Freezes and Fraud Alerts
• FTC, press release on 2025 imposter scam data (June 15, 2026)
• FBI IC3, 2025 Internet Crime Report

Provider and network documents:

• Zelle, The Facts About Zelle and Scams

Secondary context (not the sole support for any rule or deadline):

• Senate Permanent Subcommittee on Investigations staff report on Zelle, as summarized by the subcommittee chair (July 2024)
• Morrison Foerster, CFPB withdraws its Statement of Interest on consumer wires (April 2025)
• Orrick, Managing Fraud Risk in Consumer Wires (March 2025)