What scams and fraud mean in banking

Fraud is when someone uses deception to take money or information from you. Scams are schemes designed to trick you into sending money or revealing personal details. In banking, these usually target your account number, password, card details, or Social Security number — the keys that let someone drain your account or open accounts in your name.

The difference matters less than the result: both leave you out money and require you to report the loss to your bank and sometimes to law enforcement. Banks have fraud protection rules, but those protections work only if you spot the fraud quickly and report it. Knowing what to watch for is your first line of defense.

Key Takeaways

  • Banks cannot reverse wire transfers or cash transfers once they leave your account, so never wire money to someone you have not verified by phone using a number you found yourself.
  • Phishing emails and texts that look like they come from your bank are designed to steal your login credentials — your bank will never ask for your password or full account number by email or text.
  • Scammers often pose as tech support, the IRS, or your bank's fraud department and pressure you to act fast; legitimate organizations give you time to verify their identity.
  • If you notice unauthorized charges on your account, report them to your bank within 60 days to preserve your right to dispute the transaction.
  • Freezing your credit with the three major bureaus costs nothing and prevents someone from opening new accounts in your name, even if they have your Social Security number.

How phishing emails and texts steal your login information

Phishing messages look like they come from your bank but are actually sent by scammers. They typically say your account has been locked, unusual activity was detected, or you need to verify your information. The message includes a link that takes you to a fake website that looks identical to your real bank's site. When you enter your username and password, the scammer captures it.

Your bank will never ask you to click a link in an email or text to log in. If you receive a message claiming to be from your bank, do not click any link. Instead, open your banking app directly or go to your bank's website by typing the address yourself into your browser. Log in and check your account. If there is a real problem, your bank will show it in your account dashboard — you will not need an email to tell you about it.

Text message phishing, called smishing, is especially common because people trust text messages more than email. The same rule applies: never click a link in a text from your bank. Call your bank using the number on your card or statement, not a number in the text message.

Wire transfer and money transfer scams

Wire transfers and money transfer services like Western Union or MoneyGram are nearly impossible to reverse once the money leaves your account. Scammers know this and use it. They pose as someone you trust — a family member in an emergency, a company you do business with, a government agency — and pressure you to send money when ready.

The classic version: you get a call or email from someone claiming to be your grandchild, saying they are in jail or stranded abroad and need bail or airfare. They ask you to wire money and tell you not to tell anyone. Real family members will answer when you call them back at a number you know. Real government agencies do not demand wire transfers.

Before you wire money to anyone, verify their identity using contact information you find yourself. If someone claims to be from your bank's fraud department, hang up and call the number on your card. If someone claims to be a family member, call them at a number you already have. If someone claims to be from the IRS, know that the IRS does not initiate contact by phone or email — they send letters by mail.

Tech support and refund scams

Tech support scams usually start with a pop-up on your computer or phone claiming your device has a virus or security problem. The pop-up gives you a phone number to call. When you call, the scammer pretends to be from Apple, Microsoft, or your bank and asks you to let them access your computer remotely. Once they have access, they steal your banking information or install malware.

Legitimate tech companies do not contact you through pop-ups. If you see a pop-up warning, close it by pressing the back button or closing the browser tab — do not call the number in the pop-up. If you think your device actually has a problem, contact the company directly using a phone number or website you find yourself.

Refund scams work similarly. You receive an email or text saying you are owed a tax refund, a package refund, or a utility refund. The message asks you to click a link and enter your banking information to receive the refund. Scammers then use that information to drain your account or open new accounts in your name. Real refunds come as checks or direct deposits to accounts you already have — they do not require you to enter your banking details online.

What to do if you think you have been scammed

If you sent money by wire transfer or money transfer service and realize it was a scam, contact the service when ready. Wire transfers are usually irreversible, but if you report it quickly, the service may be able to freeze the money before it is withdrawn. Call the number on your receipt or the company's website — do not use a number from the scammer.

If someone used your account number or card number without permission, contact your bank right away. For credit or debit card fraud, federal law limits your liability to $50 if you report it within 60 days of the unauthorized charge appearing on your statement. For bank account fraud, your protection depends on how quickly you report it — the sooner you call, the better.

Report the scam to the Federal Trade Commission at reportfraud.ftc.gov. The FTC does not investigate individual cases, but the information helps them track scam patterns and warn the public. If you lost money to a scam involving a government agency impersonation, also file a report with that agency — the IRS has its own fraud reporting process, for example.

How to freeze your credit and monitor your accounts

A credit freeze tells the three major credit bureaus — Equifax, Experian, and TransUnion — not to release your credit report to anyone trying to open a new account in your name. If a scammer has your Social Security number, they cannot open a credit card, car loan, or mortgage without your permission as long as your credit is frozen. Freezing costs nothing and takes about 15 minutes.

To freeze your credit, visit each bureau's website and request a freeze. You will need your name, address, date of birth, and Social Security number. Each bureau will give you a PIN to unfreeze your credit later if you need to. Write down the PINs and keep them somewhere safe. If you want to explore for credit yourself, you can temporarily unfreeze your credit for a specific period.

Check your bank and credit card statements every week, not just once a month. Many banks let you set up alerts that notify you by email or text when a charge over a certain amount posts to your account. Use these alerts. The faster you spot unauthorized charges, the faster you can report them and limit your liability.

Protecting your passwords and personal information

Use a unique password for each of your financial accounts. If a scammer gets your password from one website and tries it on your bank account, a unique password means they cannot get in. Write passwords down in a physical notebook kept in a safe place, or use a password manager like Bitwarden or 1Password that encrypts your passwords.

Never share your full account number, PIN, or password with anyone — not even someone claiming to be from your bank. Your bank already has your account number. They will never ask for your PIN or password. If someone asks for these, they are a scammer.

Be cautious about what personal information you share online or over the phone. Scammers can use your mother's maiden name, your pet's name, or your address to answer security questions and reset your password. Do not post these details on social media. When a company asks for your Social Security number, ask if it is required or if you can use a different identifier.

Frequently Asked Questions

What should I do if I clicked a phishing link and entered my password?

Change your password when ready using a different device or computer. Log into your bank account and change your password to something new and unique. Then call your bank and tell them what happened so they can watch your account for unauthorized activity. Monitor your account closely for the next few weeks.

Can my bank reverse a wire transfer if I was scammed?

Wire transfers are usually permanent once sent, but contact your bank when ready if you realize you were scammed. Your bank may be able to contact the receiving bank and ask them to freeze the funds before they are withdrawn. The sooner you report it, the better your chances. After the money is withdrawn, recovery is very difficult.

If a scammer has my Social Security number, what should I do?

Freeze your credit with Equifax, Experian, and TransUnion to prevent someone from opening new accounts in your name. You can also place a fraud alert with the bureaus, which tells lenders to verify your identity before opening new credit. Both are free and take about 15 minutes per bureau.

How long do I have to report fraud on my bank account?

Report unauthorized charges within 60 days of the statement date to preserve your right to dispute them. The sooner you report, the better — your bank may reverse charges reported within 10 days, but after 60 days you may lose the right to dispute entirely. Check your statements weekly so you catch fraud quickly.

What is the difference between a credit freeze and a fraud alert?

A credit freeze blocks all access to your credit report unless you unfreeze it, which stops new accounts from being opened in your name. A fraud alert tells lenders to verify your identity before opening credit, but they can still open accounts if they cannot reach you. A freeze is stronger protection if you know your information was compromised.