It starts with a text: "Did you authorize a $950 Zelle transfer? Reply YES or NO." You reply NO — and the phone rings. Caller ID shows your bank's real name. A calm, professional agent thanks you for reporting the fraud and offers to secure your account.
Everything that follows is theft with your cooperation. The 'agent' is a scammer, the spoofed caller ID is trivial to fake, and the 'account securing' steps move your money to them.
The two moves in the script
The code grab: the scammer triggers a real one-time passcode from your bank's actual login page, and asks you to read it back 'to verify your identity.' That code is your account. Banks send codes for you to type into their website — never to read to a human, ever.
The 'safe account': you're told your account is compromised and your balance must be moved to a secure account — or sent via Zelle 'to yourself' at your own phone number. The scammer has re-registered that alias, and the money lands with them. Banks never secure accounts by having you transfer money out. They freeze things. That's the whole tell.
The one habit that beats it
Hang up and call the number on the back of your card. That's it. Any real fraud case will be documented in your account when you call in. A real bank will never mind; a scammer cannot survive it.
If money already moved, speed is everything: call your bank's real fraud line immediately and ask them to attempt a recall, then file at ic3.gov. Many banks now reimburse impostor-scam victims — but the sooner you report, the better your odds.
