Someone called claiming to be my bank — is it real?

You cannot verify a call while it is happening, so do not try. Hang up, and dial a number you already trust — the one on the back of your card, or the one on the organisation's official website, typed in yourself. A genuine bank, government agency or support desk will always be comfortable with that. If the caller pushes back, tells you there is no time, or says calling back would cause a problem, that reaction is the answer.

This kind of call is called vishing — voice phishing. The name contracts "voice" and "phishing", and the objective is unchanged from any other kind of phishing: money, a credential, a one-time code, or access to your device. What changes is the pacing, and pacing is most of the attack.

Why a live call is the hardest channel to defend

Every other form of phishing gives you something the phone does not: a pause.

An email sits in your inbox while you check a domain. A text can be put down. A call demands a response now, from a person who is speaking, in a conversation where silence is socially uncomfortable. You cannot hover over a voice.

For older adults especially, this is the costliest channel. The FTC found social media was the leading contact method for scam losses across every age group except those aged 80 and over, where phone calls ranked first.

Caller ID is not evidence

This is the single most important technical fact about phone scams, and most people do not know it.

The number displayed on an incoming call is supplied by the caller. Services that set it to anything at all are cheap and widely available. A call showing your bank's genuine published number is exactly as easy to fake as one showing a random mobile.

Voice cloning changed the family emergency

A few seconds of someone's speech — from a video, a voice note, a podcast — is now enough to generate convincing synthetic audio of them.

The result is the distress call: a grandchild in an accident, a relative arrested abroad, an executive authorising an urgent transfer. The voice is right, which historically was the strongest identity proof available in a phone call.

The FBI's 2025 Internet Crime Report included artificial intelligence as a category for the first time in the IC3's near-25-year history, recording 22,364 complaints and approximately $893 million in losses, with voice clones named explicitly among the tactics.

The recurring scripts

"Your bank's fraud team"

Often preceded by a text so the call feels expected. Suspicious transactions are described, then you are helped to move money to a "safe account", or asked to read back the code that authorises the transfer.

"Government or law enforcement"

An unpaid tax bill, a warrant, an investigation. Immediate payment, secrecy, and threats of arrest. See authority scams.

"Technical support"

Your computer is infected; permit remote access so it can be fixed. See tech support scams.

The follow-up after a data leak

Someone calls already knowing your card number and recent transactions. That knowledge came from the earlier breach or phishing page — it is not proof of anything.

The rule that ends all of them

Hang up and call back on a number you obtained yourself.

The number on the back of your card. The number on the organisation's website that you typed in. Not the number that called, not a number the caller gives you, not a number from the text that preceded the call.

Two refinements worth knowing:

• Use a different phone if you have one. An older technique held the line open so that redialling reconnected you to the scammer. Modern networks mostly prevent this, but a mobile costs nothing to use.
• Wait a minute or two before dialling if you only have one line.

What they will ask for

The same short list as every other form of phishing:

• A one-time code — always fraudulent, no exceptions
• Money moved to another account — always fraudulent
• A password read aloud — always fraudulent
• Remote access to your computer — legitimate only if you initiated the support request
• Payment in gift cards or cryptocurrency — always fraudulent

Any one of these ends the conversation, regardless of how well everything before it held together.

If one of them already happened — you read out a password or a code — work through I gave a scammer my password now, because the first hour is what decides the outcome.

When the voice on the line is someone you know rather than an institution, the test changes. AI voice scams covers why listening for a fake no longer works, and the two habits that replace it.