Bank Impersonation Scam: What to Do After Sharing a Verification Code

Break contact and reach your real bank

Stop replying to the text, call or messaging thread even if the caller ID looks like your bank. Spoofing can make a fraudster appear to use a genuine institution’s number. Open the official banking app yourself or use the telephone number on your card or a past statement. Tell the fraud department that someone obtained a one-time passcode and may have access to your account, and ask whether there have been new devices, payees, password resets or outgoing transfers. Request a case number and note the time of the call.

Ask what the institution can block now: online sessions, device tokens, instant payments, new beneficiaries, wire access and potentially the debit card. A blanket request to “freeze everything” may interrupt payroll and bills; discuss urgent protective steps and their operational consequences. A representative may ask normal identity questions through an official contact channel, but never send another one-time code to the person who approached you. If your phone number has been transferred without your consent, contact the mobile carrier through its official support channels as well.

Close the account-access gaps the code may have opened

Change the banking password from a device you trust, particularly if you reused it elsewhere. Check whether the bank lets you log out all sessions, review recognized devices, remove unknown external transfer accounts and choose stronger authentication. If the fraudster accessed your email, secure that inbox first: email reset links can allow repeated bank takeovers. Review password-recovery addresses, forwarding rules and unfamiliar sign-in notifications. If the bank requires its own procedure for a compromised login, follow it rather than treating a password reset as complete recovery.

Inspect transactions and security changes over more than one day. Some fraudsters add a recipient or mobile wallet, wait, then transact. Save screenshots of approved or pending payments, new phone numbers, beneficiary records and security alerts before an agent removes them. Do not share a whole statement publicly: it can expose unrelated account numbers and personal details. A one-time code may have authorized a specific action, not automatically every future action, so documenting which code you disclosed and what prompt it described matters to the investigation.

Report transfers in the right category

An electronic transfer a fraudster initiated using account credentials fraudulently obtained from you may qualify as unauthorized under Regulation E; that is different from a payment you personally instructed after being deceived. Federal Regulation E provides important procedures for errors and unauthorized electronic fund transfers from consumer accounts, but the facts of each authorization matter. Notify the bank promptly and specify whether you initiated the transfer, whether the fraudster used your credentials, and whether you had ever authorized that particular recipient or amount. Do not describe a transfer as unauthorized if you actually approved it; provide accurate facts and ask how the bank classified the claim.

Wire transfers, payment-app transactions, debit-card purchases and ACH debits can travel through different networks. Ask for the appropriate fraud claim and, where possible, an immediate recall or recipient-bank alert. No recall should be presented as guaranteed. For a transfer made abroad, remittance-transfer rules may add separate rights; for domestic wires, speed and finality often make prompt contact crucial. Keep case numbers separately for each payment rail and each institution involved.

The CFPB’s electronic-fund-transfer FAQs address this exact fact pattern: if an impostor tricks you into revealing a texted confirmation code and the impostor then initiates an EFT, the transfer can be an unauthorized EFT under Regulation E. Voluntarily disclosing the code through deception does not, by itself, establish that you authorized the resulting transfer. By contrast, a payment you personally initiated at the impostor’s instruction raises a different classification question. Ask the bank to record these facts separately; do not accept a blanket denial based solely on having revealed a code.

Build an evidence record while details are fresh

Create a one-page incident chronology with the original contact time, displayed number, exact wording of the request, code delivery, time you shared it, subsequent app notifications and every suspicious transaction. Preserve texts, voicemail, call logs and merchant or beneficiary details. If the bank identifies a transfer, obtain the network reference, recipient identifier when disclosable, dates and any written determination. Send documents through your bank’s secure upload channel rather than emailing full account credentials. Ask how to receive a written outcome and how to correct an account or address change.

For example, suppose you gave a caller a six-digit login code at 2:15 p.m., noticed a new payee at 2:24, and contacted the bank at 2:31 before a transfer completed. Those timestamps may be important to tracing access and evaluating what intervention was possible. An investigation may require more evidence than a screenshot of the caller’s name, because caller identification is easily spoofed. Retain copies of all messages you sent to the bank and any promised follow-up deadlines.

Protect the rest of your finances and follow up

Check linked accounts, credit cards and any financial applications authorized through the compromised login. Consider a credit-report review or identity-theft protection steps if personal identifiers were exposed, but distinguish account takeover from opening new accounts in your name. Report the impersonation to the FTC at ReportFraud.ftc.gov, and consider the FBI’s Internet Crime Complaint Center when appropriate. These reports do not replace the bank’s dispute process. If the bank’s answer seems inconsistent with the facts, request its written reasoning and use its formal complaint channel.

Recovery should not end with a single password change. Revisit your account for unusual small withdrawals, new recipients and failed logins over the following weeks, and verify automatic bills were not disabled by protective restrictions. Warn family members that a real bank will not instruct a customer to move savings to a “safe account,” buy gift cards or provide a code to an inbound caller. The goal is to regain control, preserve legal dispute rights and restore ordinary banking without taking further instructions from the impostor.

Frequently asked questions

Does sharing a code automatically make every transfer authorized? No. Authorization depends on who initiated the transfer, what you approved and the applicable payment rule. Explain the sequence accurately and request the relevant investigation.

Can I reverse money sent to a supposed safe account? Report it immediately and request a trace or recall, but reversal is not assured. The payment network, recipient access and facts affect options.

Should I call the number shown in the scam text? No. Use a trusted statement, card or the bank website you navigate to independently; numbers inside fraudulent messages may route back to the attacker.

MyBankAnswers Editorial Verdict

Treat a disclosed verification code as a serious access incident, not as proof that all your funds are gone. The strongest response is a sequence: stop contact, reach the genuine bank, block exposed access, characterize each disputed transfer truthfully and preserve a precise record. Victims often lose time trying to persuade the caller to undo a transaction; the genuine bank and payment network are the only useful channels for urgent intervention. Ask specifically about new devices and beneficiary changes, because an account may look quiet while a fraudster prepares a later payment. Recovery rules are fact dependent, and an FTC report is not a substitute for the bank’s claim process. After containment, verify that essential incoming deposits and bills still work. Independent callback is the habit worth retaining long after the incident is resolved.

Sources and verification

• FTC: bank fraud impersonation calls
• CFPB: Regulation E error resolution
• FTC: report fraud
• CFPB: unauthorized EFTs after fraudulently obtained login or code