Check the requested action
Fictional example: Nora is told to approve a “cancellation” on her phone. The screen actually describes a new transfer. She approves nothing, ends the call and contacts her bank using the number on her card. The genuine support team checks the situation with her.
Read each approval for what it actually says. A caller’s explanation does not change the recipient, amount or action displayed. If the screen and the story disagree, stop. A confident manner is not a reason to approve an unclear request.
Start a separate call yourself
Do not take the number from a newly received message or simply press callback. Open your established bank contact yourself. A transfer arranged by the original caller is still part of the same unverified conversation.
Tell the new contact: “Somebody called me about a security check. I want to confirm whether it came from you.” Note the time and claimed reason. You do not need access to internal bank procedures; ask the official service to explain the appropriate next step.
Keep three boundaries
Sign-in codes, payment approval codes and passwords do not belong in the unexpected call. Do not install remote-access software on the caller’s instructions. Do not share your screen or give them control of the device.
A request to move savings to a “safe account” is a strong fraud warning. The FTC specifically warns about this protection story. Avoid making a small test transfer to see whether the story is genuine. Sending a test amount does not establish who controls the receiving account.
Make a useful call note
Record when the call arrived, which organisation was named and what you were asked to do. For your own overview, add either “nothing approved” or the exact action you took. Keep full card details and security codes out of the note.
Preserve messages already received in case the bank needs them. Do not publish the displayed telephone number as proof of a criminal’s identity: caller information can be manipulated. The sequence and timing can be more useful for checking the incident than a public warning list.
If you already approved something
Contact the genuine bank or card service immediately. Describe the actual action rather than saying only “I clicked”: you disclosed a password, entered a code, approved a transfer or allowed remote access. That distinction helps the provider respond appropriately.
Whether a payment can be stopped or refunded depends on the circumstances. This guide cannot guarantee recovery or confirm that an account is secure. If software was installed or remote access was allowed, obtain qualified technical help as well, and use a trusted device for sensitive account changes.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Can I speak to my bank by telephone at all?
Yes. The useful checkpoint is a call you start through established bank details. The bank can then explain its own identification process.
Does a correct account detail prove who called?
No. A few known details are not sufficient identity evidence. Verify the request independently.
What if no unusual transaction is visible?
That does not fully resolve the call. Ask the genuine bank to check the claimed issue and approve nothing while it remains unclear.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- BACS: Vishing und vorgetäuschte BankanrufeSource review date:
- FTC: Angebliche Sicherheitsanrufe und GeldverschiebungenSource review date:
- FDIC: Bank-Imitationen erkennenSource review date:
