Your bank called — or did they? Verifying without risk

A call comes in, the caller ID says your bank’s name, and they’re asking about a suspicious charge and need to “verify your identity.” It feels legitimate because the caller ID matches — and that’s exactly the part that can’t be trusted. Caller ID can be faked (called “spoofing”) trivially, so a name matching your bank proves nothing.

The rule that removes all the risk

Hang up, and call your bank back using the number on the back of your card or on their official website — never a number the caller gives you, and never by pressing a number they tell you to redial. This single habit makes the entire scam impossible, because you’re now calling a number you know is real instead of trusting one they controlled.

What a real bank will never ask for

• Your full password or PIN. Banks never need your complete password read aloud — if anything, they might ask you to confirm a partial detail they already have on file.
• A one-time code you just received by text. This code exists specifically to prove a transaction is really you. A caller asking you to read it back is trying to use it to authorize something themselves, not verify you.
• Payment via gift cards, wire transfer, or cryptocurrency to “protect” your funds. This is never a legitimate bank request, under any framing.

Common scripts to recognize

“There’s suspicious activity, we need to verify your identity” often leads into asking for the very information that lets them access your account. “We’re moving your money to a safe account to protect it” is a way to get you to authorize a real transfer — to them. Both rely on urgency and fear to stop you from pausing to verify.

If you’re not sure whether it was real

Log into your account directly through the bank’s app or website (not any link from the call or a text) and check your account activity and messages yourself. If there’s a genuine issue, it’ll be visible there, and you can address it through a channel you initiated rather than one that reached you first.

If you already gave information or sent money

Call your bank immediately through their official number and explain exactly what happened — they deal with this constantly and can often freeze accounts or reverse transfers faster the sooner it’s reported. Change any passwords or PINs you may have disclosed.

When it’s worth talking to someone

If you’re unsure whether a call, text, or email involving your accounts was legitimate, we’re happy to help you think it through — part of the everyday security guidance that comes with our small business and home tech support across Manhattan.