The caller ID says your bank. The voice is professional, unhurried, and calling about fraud on your account, which is exactly what a real fraud department would do. Within ten minutes you will be asked to move your money somewhere "safe," read back a code, or buy gift cards. Here is the thing that makes all of it survivable: every imposter call, whatever the costume, is the same call, and once you can see the skeleton, the costume stops working.
The three beats
Beat one: borrowed authority. The caller is someone you are trained not to question: your bank, the IRS, Social Security, Microsoft, the police, or a grandchild in trouble. Caller ID is trivially fakeable and proves nothing. And thanks to breach data, the caller often knows your name, your bank, and the last four digits of something, which feels like proof of legitimacy and is actually just merchandise.
Beat two: manufactured emergency. Your account is being drained right now. A warrant is being issued today. The grandchild is in jail tonight. The emergency exists to shut down the one thing that kills the scam: time to think or to check with someone else. Real institutions survive you calling them back. The script cannot.
Beat three: the impossible ask. Sooner or later, the caller needs something no legitimate institution asks for by phone: a verification code read aloud, remote access to your computer, your money moved to a "protected account," payment by gift card, wire, or crypto. This beat is the fingerprint. Banks do not protect money by having you move it. Governments do not accept iTunes cards. Nobody legitimate needs the code that just arrived on your phone; as our two-factor guide puts it, a code you were asked for is a code being stolen.
Hang up, then contact the organization yourself through a number you find independently: the back of your card, the official website you type by hand, the family member's own phone. Never the number the caller gives you. This works against every imposter script ever written, including the ones that have not been invented yet, because it removes the only thing the scam controls: the channel.
Why smart people fall for it
Scam victims are not gullible people. They are people caught in a well-engineered emergency, often by callers who knew enough personal detail to sound real. The defense is not intelligence. It is a pre-made rule, decided calmly today so it does not have to be invented mid-panic: no financial action ever gets taken on an inbound call. Agree on that rule with your family, especially the members most likely to be targeted, and give the emergency scripts a family password while you are at it: one word a real grandchild in real trouble would know.
If a call already got money or information: your bank first, then IdentityTheft.gov to file and get a recovery plan, then the phone carrier if a number was ported. Speed helps most with wires and gift cards, where minutes genuinely matter.
Wondering how the caller knew your details?
Imposter scripts run on breach data. See which known breaches contain your email and what was exposed alongside it.
Run the Free Breach Scan →