Vishing and Caller ID Spoofing: Fake Bank Calls and What to Do If You Paid

Your phone rings and your bank's name pops up on the screen. The person on the line is friendly, calm and sounds completely professional. They tell you there's a strange payment on your account, or someone has just logged in from another country, and you need to act right now. They ask for the code you've just been texted, or for you to approve something in your app, or to move your money to a "safe account" while they sort it out. If that's happened to you and you've just realized it wasn't your bank, take a breath: you're far from alone, and there's still a lot you can do.

This has a name: vishing, which is fraud by phone call, and it often comes with caller ID spoofing, the trick that makes your bank's real number appear on your screen. We'll explain how it works, what to do today if you gave a code or sent money, and how to recognize the next call so you can hang up in time.

In this article

1. What vishing is (and how it usually starts)
2. Caller ID spoofing: when the call looks like it's from your bank
3. How to spot a fake bank call
4. If you gave a code or sent money
5. Will your bank cover it?
6. Imagine this happens to you
7. How to protect yourself from phone scams
8. Watch out for the second call
9. When to get help

What vishing is (and how it usually starts)

Vishing is a scam where someone calls you pretending to be a trusted organization so they can get your information or your money. The word blends voice and phishing, which is the same trick by email. Nobody hacks your phone: they persuade you to do something, and that's why it works so well.

The calls almost always lean on fear and urgency. These are the stories we hear most often:

• The suspicious payment. "We've blocked a $900 payment at an online store, was that you?" When you say no, they ask for the code you've just received "to cancel it". That code is actually what approves the payment.
• The safe account. They say your account has been compromised and that, while they secure it, you need to transfer your savings to a new account they give you. They talk you through it in your own banking app, so everything looks normal.
• The helpful app. They ask you to install an app "to check your phone" or a supposed bank app. It's usually a remote-access tool or a fake app that hands them control.
• The impersonated authority. Sometimes it isn't your bank but "the fraud department", the police or a government agency, and the pressure is even higher.

Often the call comes right after a fake text that lands in the same thread as your bank's real messages. So when the phone rings, you're already worried and the story fits.

Caller ID spoofing: when the call looks like it's from your bank

Spoofing is the part that throws people, because it breaks the rule most of us rely on: "if it shows my bank's number, it's my bank". The FCC explains that spoofing is when a caller deliberately falsifies what appears on your caller ID, often to look like a company or government agency you already trust. The FTC puts it simply: scammers can make any name or number show up.

In the US, misleading caller ID used to defraud is illegal under the Truth in Caller ID Act, and phone companies are rolling out caller ID authentication and blocking tools. In the UK, banks and phone companies created 159, a short number that connects customers of more than 99% of UK retail bank current accounts directly with their bank and, according to Stop Scams UK, can't be spoofed.

None of these filters is perfect, though, and scammers keep changing tactics. So the idea to hold on to is simple: the number on your screen doesn't prove who's calling.

How to spot a fake bank call

You don't need to be an expert. Vishing calls are very alike, and once you know what to look for, you'll spot them quickly:

• They ask for a code you've been texted, or a password. Your bank will never ask you over the phone for your full password or for one-time codes. That code is the key to your money, and if someone asks for it, however professional they sound, it's a scammer.
• There's huge urgency. "If we don't do this now, you'll lose your money." Pressure is the scammer's favorite tool, because it stops you thinking.
• They want you to move your money. A real bank freezes your card or account; it doesn't ask you to send your savings to a new "safe account".
• They know things about you. Knowing your name, address or the last digits of your card doesn't make them your bank. That information can come from data breaches at other companies.
• They want you to install something. No legitimate bank asks you to install remote-access software during a call.
• What the app says doesn't match what they're telling you. If they say you're "cancelling" something but your screen says "approve payment" or "confirm transfer", believe the screen, not the voice.

If you have the slightest doubt, hang up. Your real bank won't mind: you'll call back and, if it was genuine, they'll confirm it. If you can, make that call from a different phone or wait a few minutes, so you're sure the first line has really disconnected.

If you gave a code or sent money

If you're reading this with your heart racing because it just happened, let's take it one step at a time. What you do in the next few hours matters most, so this is the order that helps:

1. Hang up and call your bank yourself on the number from its official website or the back of your card, never one they gave you. In the UK, 159 works too. Ask them to freeze your cards, online banking and any pending payments.
2. Ask them to try to stop or recall any transfers that have already gone. If the money is still sitting in the receiving account, it can still be stopped. Note the time, who you spoke to and the reference number.
3. Change your passwords from a device you trust. If you installed an app they asked for, remove it and tell your bank, because they may have had access to your phone.
4. Keep everything: a screenshot of your call log with the number and time, the texts you received, your statements and any names or account details they gave you. Even if the number was spoofed, it helps the investigation.
5. Report it. In the US, to the FTC at ReportFraud.ftc.gov and, if you lost money, to the FBI's IC3. In the UK, to Report Fraud (or Police Scotland on 101). We explain how in how to report a scam.
6. Put your complaint in writing to your bank, listing the transactions you don't recognize and explaining exactly how it happened.

We know this is hard. They spoke so confidently that you did exactly what they asked, and that doesn't make you careless: these calls are rehearsed to fool careful people. Now it's about moving quickly, and every step you take today counts.

Will your bank cover it?

This is where a lot of people give up too early, and they shouldn't. The key is telling two situations apart:

• If they used your code to make a payment you didn't make, it's an unauthorized transaction. In the US, Regulation E limits your liability mainly based on how fast you report, and the CFPB explains that your bank generally has ten business days to investigate once you tell it. In the UK, the FCA says an unauthorized payment should be refunded by the end of the next business day, unless the bank can show you acted fraudulently or failed to protect your details.
• If you sent the money yourself, believing you were protecting it, the protection works differently, but there's still a path. In the UK, since October 2024, banks must reimburse eligible victims of these authorized push payment scams sent by Faster Payments or CHAPS, up to £85,000, as the Payment Systems Regulator explains. In the US, ask your bank right away to recall the payment and contact the receiving bank. And if they told you the payment was to cancel a fraud, you weren't agreeing to that payment, you were trying to stop it, so say so clearly in your complaint.

If your UK bank says no or doesn't answer in time, you can go to the Financial Ombudsman Service for free. We go through the rules, deadlines and a complaint template in bank fraud: will your bank refund you?, and all the options depending on how the money left in can you get money back after a scam?.

Imagine this happens to you

Imagine it's a Thursday morning and "your bank's fraud team" calls, with the usual number on your screen. They say someone is trying to send $600 from your account and that, to block it, you need to read out the code you've just been texted. You read it out. Ten minutes later another alert comes in, then another. When you hang up and open your app, there are three payments you never made.

In a case like that, the first step would be to call your bank on its official number, freeze everything and ask them to try to stop the payments. The same day, you'd report it with screenshots of the call log and the texts, and put in a written complaint saying you didn't make those payments and that you gave the code believing it would block a fraud. It's only an example, but it shows what helps most: moving fast and explaining in detail how you were tricked.

How to protect yourself from phone scams

If it hasn't happened to you, protecting yourself is easier than it sounds, and a few habits put you well ahead:

• Never share a code over the phone. Not with your bank, the police or anyone else. If someone asks, hang up.
• Hang up and call back yourself. For any call that worries you, end it politely and dial the official number from the website or your card.
• Be wary of urgency and "safe accounts". No legitimate organization will ask you to move your money to protect it.
• Always read what you approve in the app. The screen tells the truth even when the voice doesn't.
• Turn on alerts for every transaction and two-step verification. The sooner you see something odd, the sooner you can stop it.
• Talk about it at home. Older relatives get these calls a lot. Telling them that a bank never asks for codes over the phone can save them a lot of heartache.

Watch out for the second call

It's very common for scammers to call back after a scam. Sometimes they pose as your bank, the police or a company that "recovers scammed money", and ask for an upfront fee to get it all back. We completely understand wanting to fix it right now, but anyone who guarantees 100% recovery in exchange for paying first is usually the second scam. Before you pay anyone, read how to spot crypto and fund recovery scams.

When to get help

If your bank refunds you within a day or two, great: keep all your paperwork and follow through on your report. It's worth having a professional look at it when the bank refuses or doesn't reply, when you're accused of being careless, when the amount is significant, or when you sent the transfer yourself and you need to move fast to try to freeze the money in the receiving account.

We are lawyers and expert investigators specializing in online scams, cryptocurrency and cybercrime, and every case is handled by a lawyer or an expert investigator. We'll go through which transactions were made, how they fit legally and what to ask your bank for, so your claim carries weight. In many cases the money is recovered, especially if you act fast. At Kironic we do everything we can to recover your money: send us your case and we'll look at it together.