Is this call or text really who it says it is?
A call, text or email claims to be your bank, a government agency, a delivery firm or even a relative - and something about it feels off. Here is the one check that verifies who is really contacting you, and the requests that are always fraudulent, no matter how convincing the rest sounds.
The short answer
- Verification is one action: end the contact and reach the organisation on a number you obtained yourself - never one from the message or the caller.
- No bank will ever ask you to move money to a "safe account". That single sentence resolves almost every bank impersonation call on its own.
- Knowing details about you - your card number, your address, your recent transactions - is not evidence of legitimacy. It is evidence of a data breach.
- A message from an unknown number claiming to be a relative who lost their phone, followed by an urgent request for money, is the "Hi Mum" scam. Call their known number before doing anything.
- Imposter scams were the FTC's most-reported fraud category for the ninth year running, with $3.5 billion in reported losses in 2025.
End the contact, then reach the organisation yourself — on the number on the back of your card, the number on the website you typed in, or the phone number you already had for the person. Never a number from the message, and never one the caller reads out. If the call is trying to keep you on the line, asking you to move money to a "safe account", or asking you not to tell your bank or family, that alone tells you it is fraudulent — you do not need to work out which other part of the story was false.
Pretending to be someone trustworthy — a bank, a government agency, a delivery firm, a relative — is the oldest technique in fraud, and it is still the most productive one.
The FTC recorded $3.5 billion in reported losses to imposter scams in 2025, across more than a million reports — the most-reported fraud category for the ninth consecutive year, and nearly one in three fraud reports overall.
What is striking about the data is how unsophisticated the growth areas are. The fastest-rising form was a text message about an unpaid toll.
The main forms
Bank impersonation
The costliest. The FTC found business impersonators accounted for close to $1 billion in reported losses in 2025, with bank impersonators the highest within that.
The structure is consistent. A warning arrives — often a text first, so the follow-up call feels expected. Suspicious activity is described in convincing detail. Then you are helped to protect yourself by moving your balance to a "safe account", or by reading back the code that authorises the transfer.
Government impersonation
Around $920 million reported lost in 2025, up from $789 million the year before. Reports rose 40%, and the FTC attributes much of that to fake unpaid-toll messages spoofing real programmes including E-ZPass, SunPass, FasTrak and TxTag.
The rest is tax debts, benefit problems, immigration status, warrants. The tools are threats and urgency — see authority scams, and government impersonation scams for the four demands that identify a fake agency message on sight.
Business impersonation
Retailers, delivery firms, streaming services, utilities. Usually a billing problem or a subscription renewal, and usually leading to a page that collects card details.
A common variant is the refund overpayment: you are told a refund is due, "too much" is apparently sent, and you are asked to return the difference. The original transfer is fake or reversed; the return is real.
Family and friend impersonation
"Hi Mum, this is my new number, I've lost my phone." Then an urgent payment problem.
The change of number — which would ordinarily be suspicious — is explained by the story itself, which is what makes it work. Cloned voices have made the telephone version substantially more convincing; see AI scams.
Colleague and executive impersonation
Covered in phishing vs spear phishing: a request from the chief executive, or a supplier changing bank details before an invoice is due.
Where the credibility comes from
Impersonators build trust from four ingredients, and knowing them makes the construction visible.
| Ingredient | How it is obtained | Why it is not proof |
|---|---|---|
| Your personal details | Data breaches, brokers, earlier phishing | Widely available for purchase |
| A correct caller ID | Trivially spoofed | Displays a number the caller supplies |
| Correct branding | Copied from the real website | Free to reproduce |
| Confirming pre-contact | The scammer sent the earlier text | They are confirming their own message |
That fourth row deserves attention. A frequent pattern is a text saying "we will call you shortly", followed by the call. The prediction coming true feels like verification. It is not — they sent both.
Verification, which is one action
End the contact. Reach the organisation on a number you obtained yourself.
The number on the back of your card. The number on the website you typed in. Not the number that called you, not one from the message, not one the caller reads out.
If possible, use a different phone, or wait a couple of minutes before dialling.
The requests that are always fraudulent
No context makes these legitimate:
- Read back a one-time code
- Move money to a "safe account"
- Pay in gift cards, cryptocurrency, or bank transfer to a new account
- Install remote-access software after an unsolicited contact
- Confirm a full password or full card number
- Keep the conversation secret from your bank or family
Any one of these ends it. You do not need to work out which part of the story was false.
Turning that into a habit you can apply anywhere — to a caller, a stranger online, or a company you are about to pay — is covered in how to verify someone's identity online.
Take the call
Our impersonation scenarios play out the bank fraud team and the lost-phone message as real conversations, so you can find the turn.
Try it freeFrequently asked questions
- How do I verify who is really contacting me?
- End the contact and reach the organisation yourself using a number you obtained independently — the one on the back of your card, or on the website you typed in. Never a number from the message, and never a number the caller gives you. Any genuine organisation expects and supports this.
- Will my bank ever ask me to move money to a safe account?
- No. No bank anywhere has such a procedure. If a caller asks you to move money to protect it, the call is fraudulent — with certainty, regardless of how convincing everything before that point was. Banks freeze accounts and block cards; they never ask you to transfer funds elsewhere.
- How do scammers know my personal details?
- From data breaches, data brokers, and earlier phishing. A caller who knows your address, your card's last four digits, or a recent transaction has bought or stolen that information — it is not proof they work for your bank. Treat detailed knowledge as a reason for more caution, not less.
- I got a text saying my mum or child has a new number and needs money. Is it real?
- Treat it as fake until you have called the person's known number and heard their voice. It works because the change of number is explained by the story itself, and because parents respond to a child in difficulty before verifying. Cloned voices have made phone calls more convincing too — verify on a number you already had, not one given in the message.
- What is an impersonation scam?
- A fraud in which someone pretends to be an organisation or person you trust — your bank, a government agency, a retailer, your employer, a family member — in order to extract money, credentials or access. The FTC calls these imposter scams, and they have been its most-reported fraud category for nine consecutive years.
Sources
- FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 — Federal Trade Commission, 2026
- New trends in reports of imposter scams — Federal Trade Commission, 2026
- 2025 Internet Crime Report — FBI Internet Crime Complaint Center (IC3), 2026
About the author
Cybersecurity & Digital Literacy
Subash Poudel builds SafeSurf IQ, a digital literacy platform that teaches people to recognise scams by putting them in front of real ones. He writes the online-safety reference material here, working from primary reporting — FBI IC3, the FTC, Verizon's DBIR, NCSC and Ofcom — rather than secondhand summaries.
- Founder and engineer, SafeSurf IQ
- Writes and reviews the platform's phishing, scam and privacy curriculum
- Works from primary incident and fraud reporting, cited on every article
Last reviewed . Figures are checked against the primary sources listed above at each review.
Read next
- Social Engineering
What is social engineering? The techniques behind every scam
Social engineering is manipulating a person into doing something against their own interest. It is the common ancestor of phishing, impersonation, romance scams and fraud calls, and it works on a small number of predictable psychological levers.
- Social Engineering
Police or tax office called about a fine — is it a scam?
A caller says they are the police, the tax office or immigration, and that you must pay now or face arrest, deportation or a fine. Here is how to tell within seconds whether the call is real, and what to do instead of paying.
- Phishing
Someone called claiming to be my bank — is it real?
A call that says it's your bank, the police or tech support can feel completely convincing in the moment. Here is how to check without staying on the line - and why hanging up and calling back yourself is the only test that works.