Deepak Gupta

Brand and service impersonation · Also called fake bank support scam, one-time passcode scam, bank login phishing, fake banking website

Account takeover through fake bank support

Account takeover through fake bank support is when criminals pose as your bank's support staff, or run a fake banking website, to get your login details and one-time codes. Once inside your account they reset the password, lock you out, and move your money quickly, often into cryptocurrency.

How it works

Scammers text, call, or email as bank support, sometimes warning of fraudulent transactions, or place fake bank sites at the top of search results.
The victim is asked to confirm a username, password, and one-time passcode, or enters them on the fake site.
The criminals sign in, change the password, and lock the victim out of the account.
They transfer the money out fast, often to cryptocurrency wallets, which makes it hard to recover.

Red flags

Someone claiming to be from your bank asks for your username, password, or a one-time passcode.
A search result or ad for your bank leads to a web address that differs slightly from the real one.
A caller warns of fraud on your account and asks you to verify your login details.
You suddenly cannot sign in to your account, or notice deposits missing or withdrawals you did not make.

If you are targeted

Stop contact: hang up and do not share any codes or passwords.
Contact your bank at once, using the number on your card, to lock the account and ask for a recall or reversal of any transfer.
Change your banking and email passwords and check your multi-factor authentication settings.
Report it. Our Report a scam page lists where to report in your country, such as ic3.gov and ReportFraud.ftc.gov in the US.
Tell the company that was impersonated how the scammers contacted you.

Where to report, by country

Prevention

For individuals

Never share a one-time passcode with a caller; the FTC says no one from your bank's fraud department will ask for it.
Go to your bank through a saved bookmark or its official app rather than a search result or a link.
Use a unique, strong password, turn on multi-factor authentication, and never turn it off.

For organisations

Banks can flag new device sign-ins, password resets, and fast outbound transfers that happen together, and hold them for checks.
Banks can monitor for look-alike domains and fake search ads that use their brand and have them taken down.

By the numbers

Figures are for the reporting category this scam falls under, not this scam alone.

Account takeover losses through fake bank support reported to the FBI IC3 in 2025 (part of Tech and customer support scam losses reported to the FBI IC3 in 2025)	$359.7M	US, 2025, FBI IC3
Tech and customer support scam losses reported to the FBI IC3 in 2025	$2.13B	US, 2025, FBI IC3
Business impersonator losses reported to the FTC in 2025 (nearly this amount)	$1B	US, 2025, FTC

Real cases

No documented case in the atlas yet. New cases are added as they are sourced.

Delivered through: Voice phishing (vishing), SMS phishing (smishing), Malvertising and SEO poisoning

How official datasets classify it

FBI IC3: Tech/Customer Support
FTC: Business Imposters
Scamwatch: Account or identity takeover scams

Questions

Will my bank ever ask for my one-time passcode?: No. The FTC says no caller, especially someone from your bank's fraud department, will ever ask for your verification code. Anyone who does is trying to take over your account.
What should I do if I have been locked out of my bank account?: Call your bank on the number on your card straight away so it can freeze the account and try to recall any transfers, then report it at ic3.gov or your national reporting service.