An unexpected call from your bank may be genuine. It may also be someone using your bank’s name, telephone number and sense of urgency to reach your account.
Don’t try to settle that question inside the incoming call. Don’t provide information, read back a verification code or use a number supplied by the caller. End the call, choose a contact route you trust independently and ask the bank to verify the claimed activity.
That sequence works even when the caller sounds professional, knows something about you or appears to be calling from the number on your card.
Caller ID is not proof
A familiar name or telephone number on the screen can make a call feel safe. It’s evidence about what your telephone displayed, not proof of who is speaking.
Fraudsters can alter the caller information shown on a telephone. The Financial Consumer Agency of Canada warns that caller ID can be spoofed. The Canadian Anti-Fraud Centre likewise advises people not to assume that the name or number on the display is accurate.
The caller may also know your name, bank, partial card information or recent circumstances. Those details can make a story more convincing, but they still don’t establish that the call came from the bank.
What to do during the incoming call
You don’t need to accuse the caller or diagnose the situation. Keep the conversation short.
- Don’t provide or confirm personal, account or card information.
- Don’t read back a code sent by text message, email or an authentication app.
- Don’t move money, add a payee, install software or grant remote access.
- If useful, note the caller’s claimed name, department, reason for calling and any reference number.
- Say that you will contact the bank through its usual channel, then end the call.
A genuine employee can record the issue or explain how to reach the correct department. A caller who objects to independent verification, threatens consequences or insists that you remain on the line has given you another reason to stop.
Start a trusted route yourself
After ending the call, don’t press the callback button and don’t use a telephone number, link or app supplied by the caller.
Instead, obtain the bank’s contact information from a source you already trust, such as:
- the telephone number printed on the back of your physical bank or credit card;
- a recent statement;
- the bank’s official app that you installed previously; or
- the bank’s website reached through an address or saved bookmark you established independently.
Tell the bank that you received an unexpected call and describe what the caller claimed. Ask whether the bank attempted to contact you and whether the account shows the activity discussed.
The Canadian Anti-Fraud Centre’s guidance about the bank-investigator scam recommends calling the number on the back of the debit card. It also advises using a different telephone when possible or waiting before placing the outgoing call. This is particularly useful if you’re uncertain whether the original connection has fully ended.
Treat unexpected verification codes as evidence
A code sent by the real bank can still be part of a fraudulent sequence.
A scammer may already have enough information to begin a sign-in or password-reset attempt. That action causes the real service to send a genuine code to you. The scammer then asks you to read it aloud, claiming that the code will cancel a transaction or confirm your identity.
The code is real. The person asking for it may not be.
The Canadian Anti-Fraud Centre’s current guidance on protecting one-time passcodes says not to share them and to verify requests through trusted contact information. Its bank-investigator guidance describes the same technique being used to obtain access to bank accounts.
If you receive a code you didn’t request, don’t read it to an incoming caller. Record the time and contact the institution independently.
A real bank may still need to speak with you
The safe response isn’t based on assuming that every call is fraudulent. Banks do contact customers about legitimate account activity.
Independent verification separates the message from the route that delivered it. If the call was genuine, the bank can continue the conversation after you reach it through a trusted channel. If it was fraudulent, ending the incoming route prevents the caller from controlling the verification process.
This approach is deliberately slower than reacting inside an urgent call. That’s an advantage.
If you already shared information or a code
Contact the actual bank promptly using a trusted route. Describe exactly what happened rather than only saying that you may have been scammed.
Useful details include:
- what information you supplied;
- whether you read back a code;
- whether you approved a sign-in or authentication prompt;
- whether you logged in while the caller remained on the line;
- whether remote-access software was installed;
- whether money was moved, a payee was added or a payment was approved; and
- the approximate time of the call and any related messages.
Ask the bank what it can still secure, stop or investigate. Follow its current compromised-account process. If a password was disclosed or entered through a route controlled by the caller, change it through the real service and check whether it was reused elsewhere.
Don’t approve another prompt or share another code because someone calls back claiming to repair the incident.
If remote access or installed software was involved, stop sensitive work on the affected device. Use another trusted device for urgent banking and account recovery when reasonably available.
If money was moved
Tell the bank how the transaction occurred:
- Did you send or approve it after being deceived?
- Did someone gain access and move it without your approval?
- Is it pending or complete?
- Which account, card or payment service was involved?
Different payment methods and circumstances can have different procedures and limits. Ask what remains possible, keep the case number and record the result. Don’t assume that a transfer can or can’t be recovered before the provider reviews it.
Be cautious of anyone who later promises guaranteed tracing or recovery in exchange for an advance fee.
Report the incident
If you lost money, exposed sensitive information or believe someone attempted to take over an account, preserve relevant messages, dates, transaction details and case numbers.
The Canadian Anti-Fraud Centre accepts reports through its Report Cybercrime and Fraud service and by telephone at 1-888-495-8501. Contact local police as well when money was lost, identity information was used or the circumstances create a safety concern.
Keep passwords, PINs, complete card numbers and one-time codes out of an ordinary incident log.
A compact decision card
Stop. End the call. Verify independently.
- Stop: Don’t provide information, codes, money or device access.
- Record: Note what the caller claimed without investigating through the call.
- End: Hang up.
- Choose: Obtain the bank’s contact route independently.
- Verify: Ask the bank whether the call and claimed activity were genuine.
- Recover: If anything was disclosed or moved, describe the exact action and follow the bank’s current process.
The most important choice isn’t whether you trust the voice. It’s whether you control the route used to verify it.
Related Tartanleaf resources
The free Smart Tech Toolkit provides practical scam checks and recovery paths. Smart Tech for Real People: Scam Safety explains impersonation, pressure tactics, account compromise and recovery in greater depth. The Kindle and paperback editions are available on Amazon.
Sources checked
- Financial Consumer Agency of Canada: FCAC warns Canadians to beware of unsolicited telephone calls asking for personal and financial information
- Canadian Anti-Fraud Centre: Bank investigator
- Canadian Anti-Fraud Centre: Securing your online accounts – protect your one-time passcodes
- Canadian Anti-Fraud Centre: Protect yourself from fraud
- Canadian Centre for Cyber Security: What is voice phishing (vishing)?
Fraud techniques, provider procedures and reporting routes change. Use the current instructions from the financial institution and public agency responsible for the affected account or report.