How to spot imposter scams
These sophisticated scams start with a phone call, email, or text that appears to come from a trusted source, so it’s important to know who you’re really talking to. Margarita Alvarez, head of Wells Fargo Risk Payment Programs, shares these fraud-fighting tips.
Key takeaways
- Imposters pretend to be your bank, the government, a technical support expert, or other trusted figure, business, or organization. They can also masquerade as a relative in distress.
- Scammers can spoof official phone numbers and may even have information about you.
- The latest imposter scams involve card replacement, AI-enhanced family emergency calls, payment app refunds, and cryptocurrencies.
- Fraudsters find ways to take advantage of the busy holiday season, so take special care during this time of year.
- Guard your personal and financial information.
- Only send money to people you trust and have verified, and don’t feel pressured to make rushed or out-of-the-ordinary payments.
- Report impersonators and identity fraud immediately.
A customer came into a Florida branch concerned about her account. She had received an email from an antivirus software company she recognized, saying she was going to be charged a payment unless she called a specific phone number. When she did, she was immediately talked into giving control of her computer to an individual, who was then able to log in to her banking account and complete unauthorized transfers and transactions. At the branch, the banker reached out to all the appropriate departments to secure the customer’s account and block the scammers from taking more money, but the damage was done.
Imposter scams were the top fraud category in 2023, according to the Federal Trade Commission, with reported losses of $2.7 billion. “That’s a 14% increase from the previous year alone,” Alvarez said. “We are continuously innovating and evolving the way that we protect our customers from losing their hard-earned money to scams and fraud.”
What is an imposter scam?
These are scams that involve people pretending to be your bank, the government, a technical support expert, or other trusted figure, business, or organization. They can also masquerade as a relative in distress. “Their sole intent is to get access to your bank accounts and rob you of your funds,” said Alvarez.
Scammers can spoof official phone numbers and may even have some information about you. By appearing legitimate, they attempt to convince you to give them your personal information and your money.
Scammers posing as an IRS agent, IRS collection agency, or another government agency may use phishing emails, smishing texts, or vishing phone calls to obtain a payment or sensitive information (such as usernames, passwords, Social Security numbers, and account details). Scammers may also attempt to contact you through social media or use video calls. Bank imposter scammers may attempt to get you to send them money, provide access to your device (phone, computer, laptop, or tablet), or share your password, PIN, or one-time access codes, tricking you by saying you need to reverse a transfer, receive a refund, “stop fraud,” or something similar. The information can be used to access your account, apply for benefits or refunds in your name, or steal your money.
What are the current imposter scams?
Scammers are constantly trying to add a new trick to old scams. For example, according to the FTC, in reporting from 2020 to 2023, scams starting with a phone call have plummeted, while those starting with a text or email have increased. In that same period, people reported skyrocketing losses through bank transfer and cryptocurrency. Many scammers impersonate more than one business or government organization in a single scam. For example, a fake retail employee might transfer you to a fake bank or federal employee for “help.”
The latest types of fraud involve card replacement, AI-enhanced family emergency calls, payment app refunds, and cryptocurrencies. These are trending imposter scam examples Alvarez’s team is tracking, so you know what to look out for:
What’s the difference between fraud and scams?
Fraud is when a bad actor uses stolen information, such as a Social Security or credit card number, in an unauthorized way, like filing a false tax return, without the victim’s knowledge or consent.
Scams trick people into authorizing a financial transaction or willingly supplying personal information, which makes it difficult to recover any money.
For more information, resources, and tips on spotting and avoiding scams, visit the Wells Fargo Security Center.
1. Card replacement
The scheme: You receive a call or text from someone posing as a banker, who claims your debit card has fraudulent charges or has been compromised. They may ask you for your PIN for “verification” and to program the new card. In order to get you a new card or to recycle your compromised one, they may ask you to mail the card — even if they tell you to cut it up first — to a specific address which they say is your bank, or they may even send a “bank representative” to pick up your physical card at your home. “Literally, a real person drives to your home to pick up the card,” Alvarez said. “It sounds absurd but it’s happening.”
The truth: This puts your card and PIN directly in the hands of the fraudster. These bad actors may use a spoofed number and they may even have some identifying information about you to make it sound legitimate. Wells Fargo will never send you an unexpected or unsolicited communication asking for your card or send someone to collect it. We will only send you a code when prompted by an action that you initiated, such as signing on to online banking, sending money, or calling us directly.
What to do: Providing personal information such as one-time passcodes, passwords, or PINs can give scammers access to your account and your funds. And if you provide a scammer that information to access your accounts, you may not be able to get your money back no matter how fast you report the scam.
2. AI-enhanced family emergency
The scheme: You receive a call from a grandchild, child, or another close relative or friend in crisis, who asks you to wire money to bail them out of jail or similar. This is commonly known as the grandparent scam.
The truth: Scammers are using AI to clone the voice of a loved one or trusted individual and to create deepfake calls, images, and videos. Voice impersonation is becoming easier and more effective with AI. According to online security firm McAfee, scammers using AI only need 3 to 4 seconds of a voice recording — shorter than the average video posted to social media — to clone a voice. “Scammers are even able to visually mimic a loved one, in order to get you to transfer funds on their behalf,” said Alvarez.
What to do: Only send money to someone you know and trust. If you do get an unexpected or suspicious call, confirm the caller’s identity with a secret code word or similar. Remember, once you approve sending the funds, the money leaves your account and in most cases it’s unrecoverable.
Read more
What to know about AI scams and how to help protect your assets
How to protect your payments as AI changes the fraud landscape
3. Payment app refund scams
The scheme: You receive a text or email asking you to confirm or decline a fake payment or charge. If you reply to the message, “a bank representative” may call you back. To “reverse” the payment or to keep further “fraud” from occurring in your account, you are asked to send money via another peer-to-peer payment method, a gift card, a wire transaction, or directly into another account.
The truth: These payment methods are immediate forms of payments, which, like cash, are unlikely to be recovered once it has left your account.
What to do: Don’t be pressured or rushed into making a transaction. If someone asks you to make a payment using a gift card, cryptocurrency, or a prepaid card, it’s a clear sign of a scam. Don’t do it.
4. Bitcoin and other cryptocurrency investment scams
The scheme: You receive a text or email — either out-of-the-blue or from a trusted new acquaintance — that promises big, quick returns on an investment in cryptocurrency, digital currency that includes bitcoin. They might even have a fake investment website, which will be thin on details.
The truth: The fraudster will ultimately vanish with your funds. There has been a rise in investment and cryptocurrency scams, a trend Wells Fargo experts anticipate will continue.
What to do: Trust your gut. If you receive an unexpected text, email, or phone call, do not respond or click any links. Pause to check the legitimacy of the communication. To help protect yourself when making investments, always verify that the financial professional or institution is properly licensed and registered. Remember, if it seems too good to be true, it probably is.
Take extra care during the holidays
“We see scammers taking advantage of people’s emotions and the hustle and bustle of the season,” Alvarez said. Quick financial decisions you make under pressure — like that dash to grab a hard-to-find present or limited-time deal you click on your phone — can put you at greater risk of cybercrimes like credit card fraud, phishing, or buying fake products.
How to report Wells Fargo impersonators
Reporting fraud, even if you think the matter is insignificant, helps us identify new and emerging threats. We continue taking significant measures to protect customers from fraud and scams, investing hundreds of millions of dollars annually to advance our security measures and technology.
Phishing emails and texts
- If you clicked a suspicious link, opened an attachment, or provided any personal account information, call 1-866-867-5568 right away.
- If you did not respond, forward the suspicious email or text message to reportphish@wellsfargo.com.
Suspicious phone calls
- If you sent a payment or provided personal account information to someone claiming to be from Wells Fargo, call 1-866-867-5568 immediately.
- If you did not respond, email reportimposter@wellsfargo.com with as many details about the call as you can recall.
Package shipments
The scheme: You receive an email or text stating there is a problem with a delivery. You click on what looks like a tracking code link to confirm your address or provide your phone number or other personal information.
The truth: You are taken to a fake site, which captures your personal or financial information. Clicking the link can even install malware into your device.
What to do: If you’re not sure a message is legitimate, contact the shipping company directly using a phone number from a website or other source you know is real. Don’t use the information in the message and don’t click any links.
If you recently ordered something, go to the site where you bought the item and look up the shipping and delivery status there.
Shopping online
The scheme: You see an ad in your social media feed or receive an email offering merchandise with unbelievably low prices. The link takes you to an unfamiliar website, and you enter your credit card information to make a purchase.
The truth: Although you recognize the seller as a legitimate or well-known brand or even as a friend, their online profile may have been hacked or spoofed.
What to do: Does a price look too good to be true? Try finding the brand’s official product page or see if the deal is reflected on other pages for the same product. If an ad looks suspicious, check if “https” is at the beginning of the linked webpage’s URL and that there’s a closed lock or broken key icon next to it. If so, then the site is valid, and the data submitted on the site is encrypted.
Use caution when doing business with sellers you don’t know who push you to pay quickly through immediate payment apps, online wire transfers, or gift cards. These methods are immediate forms of payment, just like cash, making funds very hard to recover once the money has left your account.
Don’t take the bait from scammers
Although the details of the latest scams may change, the ways you can protect yourself are constant. It’s up to you to stay aware and alert in case someone does approach you. Here’s how to thwart imposters:
Wait and validate. Verify any unexpected requests that come through email, phone calls, and texts to confirm you’re speaking with a legitimate source.
Don’t trust caller ID. Scammers can “spoof” legitimate numbers by altering caller ID.
Guard your personal information. Don’t share sensitive data such as passwords, PINs, or one-time passcodes with unknown individuals. Put safeguards on your computer to ensure that messages are encrypted and that your computer is safe. Change account numbers, phone numbers, credit and debit card numbers, and passwords if your information is compromised.
Add security tools to your accounts. This includes account alerts, card controls, and sign-on authentication and verification. Wells Fargo customers can use Fargo Virtual Assistant.
Be skeptical. If it sounds too good to be true, it probably is.
Be leery of sending money in any form. Verify intended recipients. Only send money to someone you know, trust, and whose identity you can confirm. Once you approve sending the funds, the money leaves your account and in most cases it’s unrecoverable.
Stay connected. Maintain open communication with trusted contacts, seek advice, and say something if you’re ever solicited for any money.
Pause before clicking. Avoid links in suspicious emails or texts.
“Recently, I got a call from someone saying there was fraudulent activity on my account, and I needed to provide my password and authentication so they could stop the fraud. I quickly checked my Wells Fargo mobile app to make sure everything was in order and then hung up,” Alvarez said. “It’s super important to stay vigilant and don’t hesitate to step away from the situation.”
More tips to protect yourself and loved ones
Elder fraud and financial abuse
Footnotes
- Due to technical reasons, some email messages forwarded to reportphish@wellsfargo.com may be rejected by our server. If this occurs, please delete the suspicious email or text message. Wells Fargo regularly works to detect fraudulent emails and websites. Thank you for taking steps to protect your personal and financial information. ↩
