Real Bank Alert vs Account Takeover Impersonation Message
How to tell a genuine bank security alert from a fake message designed to trick you into handing over your credentials or authorising a payment.
Last reviewed: 1 June 2026
Banks really do contact customers about suspicious payments, and those calls and messages stop genuine fraud every day, so the instinct to take them seriously is a good one. Impersonators rely on that. The fake version arrives with the bank name on your caller display, uses the language you would expect, and describes an attack already under way on your account. From there everything is built to keep you moving: a passcode to read out so they can stop the payment, an account to move your balance into while they investigate, a warning that hanging up will let the transfer complete. People who fall for this are not careless, they are being told their savings are draining while they listen. The distinction that matters most is direction. A real bank never needs you to move money or hand over a code.
Side-by-side comparison
| Genuine bank security alert | Account-takeover impersonation message | |
|---|---|---|
| Content of alert | Names a specific transaction, merchant, or amount that corresponds to something in your account history | References a vague 'suspicious payment' with no specific merchant, amount, or transaction ID |
| Action requested | Asks you to confirm or decline via your banking app or by calling the number on the back of your card | Asks you to click a link, call a specific number in the message, or approve a 'reversal payment' |
| One-time passcode use | OTP is sent only for actions you initiated in your banking app — never requested by your bank over the phone | Caller asks you to read out an OTP 'to verify your identity' or 'to cancel the fraudulent payment' |
| Reverse payment request | Banks never ask you to transfer money to a 'safe account' to protect it from fraud | Instructs you to move funds to a 'secure holding account' they control while they 'investigate' |
| Caller ID | Bank may call from its published number but will never object to you hanging up and calling back | Spoofs the bank number; insists you must not hang up or the fraud window will expire |
| Personal detail handling | Partial verification only — never your full password, PIN, or card number | Asks for full card number, PIN, memorable word, or internet banking password to 'verify you' |
Common red flags
- Asked to move money to a 'safe account'
- Caller insists you must not hang up
- Asked to read out an OTP the bank is sending
- Alert references a transaction with no specific details
- Caller asks for your full PIN or internet banking password
Verification steps
- Hang up and call the number on the back of your debit or credit card
- Never read an OTP to anyone who called you — your bank will never ask for this
- Check your banking app directly for any real transaction alerts
- Tell a trusted person if you receive an unexpected urgent bank call before taking any action
What not to do
- Do not move money to any account because a caller instructed you to
- Do not read out an OTP or one-time passcode to an incoming caller
- Do not provide your full PIN, password, or card number to anyone who called you
A safe response
Say that you will call back, then hang up. You do not owe an explanation, and a genuine adviser will not argue with it. Wait a minute or two, then ring the number printed on the back of your card, or use the call function inside your banking app, so the line is one you obtained yourself. Ask them to look at the account and tell you what is actually there. If you have already moved money or shared a passcode, ring the bank on that same number now and report it to your national fraud reporting service. Reimbursement is the bank decision, but reporting quickly gives the best chance of stopping funds.
Frequently asked questions
How quickly should I report it if I have already transferred the money?
Immediately, even if it is the middle of the night, because banks can sometimes contact the receiving bank and freeze whatever remains before it is moved on. Ring the number on the back of your card and say plainly that you were tricked into authorising a transfer. Then report it to your national fraud reporting service. Whether you are reimbursed is decided by the bank under the rules where you live, but reporting early gives the strongest chance of recovering anything.
Can scammers really fake my bank phone number?
Yes — telephone number spoofing is straightforward and cheap. Seeing your bank number on caller ID does not confirm the caller is your bank. Always hang up and call back on the number from your card.
What is a safe account scam?
A variation of bank impersonation where the caller tells you your account is compromised and instructs you to move funds to a 'safe account' they control. Banks never ask customers to do this.