Security Matters: Title Edition

Bank Impersonation Scams

Fraudsters are increasingly impersonating financial institutions to gain trust — and gain access to sensitive information.

The FBI has issued an alert warning about account takeover fraud involving criminals who impersonate financial institution support personnel. These scams often rely on social engineering and emotional manipulation to convince victims that immediate action is required. Fraudsters may spoof a bank’s phone number, raise concerns about suspicious account activity or claim they need to verify online banking information.

Their objective is simple: create enough urgency and credibility to convince you to reveal sensitive information, provide authentication codes, click a malicious link or grant access to your device or accounts.

For businesses, the takeaway is clear: suspicious communication that appears to come from your bank should never replace independent verification.

Anatomy of a Bank Impersonation Scam

Understanding common tactics can make them easier to recognize.

Bank impersonation scams can take many forms, but several tactics are increasingly common.

• Phone spoofing: Caller ID can be manipulated to display a phone number associated with a legitimate financial institution. A fraudster may then fabricate a scenario involving suspicious transactions, online banking activity, cybersecurity concerns or account users. They may also request remote access to your computer or device.
• Phishing text messages: Fraudulent SMS messages can be designed to resemble legitimate bank communications. These messages often create urgency and direct recipients to provide sensitive information, respond to the message or click a malicious link.
• Fabricated websites: Phishing messages may include links to fraudulent websites designed to imitate legitimate financial institutions. Information entered on these sites — including usernames, passwords and authentication codes — can be captured and used by fraudsters.

If you receive a suspicious communication, avoid responding, providing information, clicking links or granting remote access. Instead, independently contact your bank using a trusted phone number.

Practical Steps to Strengthen Your Defenses

1. Pause and verify
   If you receive an unexpected call, text or email claiming to be from your bank, stop before taking action. End the communication and independently contact the bank using a trusted number, such as the number of your dedicated Banking team or on your bank card, account statement or official website. Avoid redialing the incoming number or using contact information supplied in the suspicious communication.
2. Protect sensitive information
   Safeguard account numbers, login credentials, authentication codes and other confidential information. Avoid saving or storing sensitive information in unsecured applications or locations on your computer.
3. Be cautious of urgency and unusual requests
   Fraudsters often create pressure by claiming an account is compromised or immediate action is necessary. Be especially cautious of unsolicited requests for credentials, passcodes, fund transfers or remote access to your computer or device.
4. Strengthen account security
   Use unique, strong passwords and multi-factor authentication (MFA) where available. For business accounts, consider dual-control procedures and appropriate access restrictions to reduce the risk associated with compromised credentials.
5. Enable and monitor account alerts
   Use available transaction and security alerts to help identify unexpected activity. Regularly review account activity and statements and promptly investigate transactions or changes you do not recognize.
6. Build fraud awareness across your organization
   Anyone on your team can be targeted. Regularly remind employees about impersonation scams, phishing tactics and verification procedures so suspicious communications are recognized and escalated quickly. 

What to Do If You’re Contacted

Customers Bank will never contact you by telephone, send you an email or text message, or written communication requesting that you validate or provide a one-time passcode, your online banking User ID, or password. If a call, text or email doesn’t feel right, trust your verification process — not the communication itself.

End the interaction and independently contact Customers Bank using a known, trusted channel to confirm whether the communication was legitimate. If you believe sensitive information has already been disclosed or your account may have been compromised, contact the Bank immediately.

Fraud prevention is not just about recognizing suspicious messages — it’s about creating disciplined verification habits before taking action.

At Customers, we help our title clients move quickly, confidently and securely — with the controls and expertise required in today’s threat environment. To learn more about Customers’ Title Solutions Group or connect with a team member, click here.

*Your company and team are solely responsible for establishing, maintaining and evaluating its own internal controls and fraud prevention procedures. While Customers Bank may share insights and best practices, we do not assume responsibility for a company’s fraud prevention program or the outcome of any specific transaction.

**As a reminder, Customers Bank will never contact you by telephone, send you an email or text message, or written communication requesting that you validate or provide a one-time passcode, your online banking User ID, or password.