Fake Bank Adviser Calls: How to Spot the Scam and What to Do

The phone rings, the screen shows your bank's name or number, and a calm, professional voice tells you that suspicious activity has been detected on your account. Within minutes, the account can be emptied. Bank impersonation is one of the most widespread frauds in Europe because it plays on fear and trust at the same time. Here is how it unfolds, how to recognise it, and what to do if you have already gone along with it.

The typical script

Details vary, but the thread is almost always the same. The scammer contacts you, often after collecting your details from a data leak, a fake delivery text or a phishing site. He introduces himself as someone from the bank's “fraud” or “security” department, knows your name and sometimes your IBAN or the last digits of your card, and tells you an unusual payment has just been detected.

To reassure you, he may send an SMS that looks like it comes from your bank, or invite you to check that the number calling you matches the one on your card. He then explains that you must secure your account right now: cancel the payment, block the card, move your money to a “safe account”, or approve a notification in your banking app. Each of these requests is, in reality, the fraudulent transaction itself.

The pressure never stops: “we only have a few minutes”, “don't hang up or the payment goes through”. This pace is precisely what prevents you from thinking.

Why the number on the screen proves nothing

The number displayed when a call comes in (caller ID) is information the caller can, in some cases, falsify. This is called number spoofing. Scammers display the official number of a branch or customer service, sometimes even the one printed on the back of your card. It reassures victims enormously, which is exactly why it is used.

Requests that should alarm you immediately

• Reading out an SMS code (card authentication code, login code, validation code). That code authorises an operation in your name; nobody needs it to “protect” you.
• Approving a notification in your banking app to “cancel” a payment. Approving means authorising.
• Transferring money to a “safe”, “transit” or “temporary” account. No bank moves your money this way.
• Installing a remote-control app (AnyDesk, TeamViewer or similar) so they can “check your device”. The scammer then sees your screen and can act as you.
• Adding your card to a mobile wallet (Apple Pay, Google Pay) with a code they dictate: the card is then enrolled on the caller's phone.
• Giving your login and password, or your digital security key.

Any single one of these is enough to conclude it is a fraud attempt, however polite the tone and precise the vocabulary.

The right reflex: hang up and call back yourself

The reflex that defuses nearly all of these attacks is simple. Hang up, wait about ten seconds to be sure the line is cut, then contact your bank yourself. Use the official app or a number you found on your own (back of your card, bank statement, official website). Never call back the number that just called you, and never reply to an SMS inviting you to do so.

If the caller was a scammer, your bank will confirm it and you will have lost two minutes. If it was a genuine call, the bank can check things with you in proper conditions. Either way, hanging up costs you nothing.

What to do if you have already approved or shared a code

1. Call your bank immediately and ask for the card to be blocked, the operations disputed and, if possible, a recall of any transfer that has just left. The first hours are decisive.
2. Cut remote access if you installed an app: uninstall it, disconnect the device from the internet, then change your passwords from a different device.
3. Keep the evidence: screenshots, texts, call log, times, amounts, and the IBANs of the receiving accounts.
4. File a police report with the evidence. Banks often ask for the report number.
5. Report the scam to your national authority (for example your consumer protection agency or cybercrime reporting portal). In France, the national information line for scam victims is 0 805 805 817.

Your rights: will the bank refund you?

Under the EU Payment Services rules as applied across Europe, when a payment is unauthorised, the bank must in principle refund you promptly, generally by the end of the next business day, unless it has reasonable grounds to suspect fraud on your part. You generally have 13 months from the debit date to dispute an unauthorised transaction. Rules and case law vary by country, so check what applies where your account is held.

The difficulty arises when you approved the payment yourself, for instance by confirming a transfer in the app. The bank may then argue gross negligence on your part. Courts examine these cases one by one, and strong authentication alone does not necessarily prove negligence. Refund is therefore neither automatic nor excluded. If your bank refuses, you can go to its ombudsman, and take advice from a consumer organisation or a lawyer. This text is general information, not legal advice.

Everyday habits that reduce the risk

• Turn on payment notifications and read the wording before approving anything.
• Set payment and transfer limits that match your use; you can change them in the app at any time.
• Be wary of fake delivery, refund and tax texts: they are used to collect the details that make the next call credible. See our guide to fake delivery texts.
• Tell your family, especially older relatives, that a bank will never ask for a code or a transfer over the phone.
• Since October 2025, euro-area banks must offer a payee verification check (name versus IBAN) before a transfer. If a warning appears, read it.