How To Spot a Bank Impersonation Scam and What To Do Next

How to spot a bank impersonation scam

You get a call, email or text claiming to be from your bank. There’s a problem with your account and you need to act quickly. It seems unusual so you respond before stopping to verify who’s contacting you. In many cases like this, it’s not the financial institution on the other end, it’s a scammer, trying to elicit an urgent reaction – and gain your financial details.

Bank scams like these are becoming more common, with the Competition Bureau identifying impersonation fraud – where someone pretends to be a trusted organization – as one of the fastest-growing threats facing Canadians¹. In this case, fraudsters pose as bank employees, hoping to win your trust so you’ll share card details, passwords, one-time passcodes, or transfer money at their direction. The goal is to gain access to your account or complete transactions without your permission.

Understanding how these scams work can help you recognize what’s going on before it’s too late. Below, we break down the warning signs and what to do if you spot any.

How scammers gain your trust

A bank impersonation scam may begin in several ways. You might receive a phone call, email or text from someone claiming to work for your bank. You may already be familiar with some of the terms used to describe these tactics. Phishing or smishing, for example, uses fraudulent emails or text messages to trick you into revealing personal and/or financial information. When the same message comes by phone call, it’s known as vishing.

Whatever the method, the scam often starts with an apparent problem, such as suspicious activity on your account or an unauthorized transaction on your debit or credit card. The person contacting you then offers a solution, but it requires you to share information or take some kind of action. You may be asked to²:

• Provide your account information, password, one-time passcode, contact information, payment reference number or other sensitive details;
• Send a payment to the “bank”;
• Transfer funds to yourself in order to secure your account; or
• Initiate another transaction to “secure your profile.”
• Activate call forwarding, which allows scammers to receive SMS or calls that are meant for you, including one time verification calls or texts.

Pay attention to how the conversation unfolds. Is the caller keeping you on the phone, using misdirection or creating a false sense of urgency to pressure you into sharing sensitive information or following their instructions?

Some scams take the request offline. For example, you may be told to put your debit or credit card in an envelope with your PIN or password, then leave it somewhere or hand it to a courier who comes to collect it.

One of the challenges is that scammers can imitate phone numbers and SMS short codes to make a call or text appear to come from a trusted source, also known as spoofing.,  Instead of focusing solely on whether the caller or communication seems convincing pay attention to what they’re asking you to do.

Protecting yourself

What should you do if a call, email or text just doesn’t seem right? Start by taking a moment to identify who’s contacting you through a verified or trusted channel.

If you’re on the phone, hang up and call your bank using the number on the back of your debit or credit card. It’s important that you don’t use a number provided by the caller as that can be part of the scam. Ask your bank whether there is any record of the reported problem or the person who contacted you. Rest assured that even if the original call was legitimate, a bank representative will understand why you chose to call back.

If the contact comes by email, don’t reply, click any links or open attachments. Instead, access your account through your bank’s official website or app, or contact the bank using a verified phone number.

For a suspicious text, don’t click the link, call the number provided or share any information. Verify the request using your bank’s official contact information. You can also report the text to your telecommunications company by forwarding it to 7726 (which spells SPAM), then delete it from your phone.

If you’ve shared banking information and think your account may be at risk, contact your bank immediately using its official phone number on the back of your card.

RBC clients can use the self-serve locking feature through RBC Mobile or Online Banking to secure a card until they can reach the bank.

Most importantly, give yourself time. Treat unsolicited calls, emails and social media messages with caution, and don’t let anyone rush you into sharing information or taking some kind of action. A brief pause may be all you need to recognize that something isn’t right.

What RBC will never ask you to do

RBC will never ask you to:

• Initiate any type of transaction on its behalf;
• Provide a one-time code sent by text, email or voicemail to identify yourself over the phone or in person;
• Download a remote-access application;
• Disclose your PIN;
• Send an e-Transfer to your financial institution or yourself for any reason;
• Complete digital two-step authentication when initiating contact with a client, including a one-time passcode, ID verification or PIN verification; or
• Create a new online banking password with an advisor or share your password with anyone.

Visit the RBC Cyber Security hub for more information, and check RBC’s current scam alerts regularly to stay informed.