Bank impersonation
by SMS and WhatsApp

Because your phone groups texts by sender name, and nobody checks that name. When a bank texts you, the screen doesn't show a phone number but a piece of text: the bank's name. Whoever sends the message writes that text, and the SMS system doesn't verify that they're entitled to use it. So someone impersonating your bank types exactly the same name, and your phone, which has no way of telling them apart, drops their message into the same conversation as the genuine codes you've been receiving for years. That is what disarms almost everyone: the thread is real, the history is real, and the latest message looks like just another one. So where a text appears proves nothing. What matters is what it asks of you: if it sends you to a link, a phone number or to do something in a hurry, it isn't the bank.

No. The number shown on your screen when someone calls can also be faked, with tools that need no special knowledge. Seeing your bank's customer service number, even with the name you saved in your contacts, only means someone chose to display that number, not that the call comes from the bank. It is the second piece of the same scam: first the text in the usual thread, then a call from the usual number, and together they seem to confirm each other. They don't, because both are faked the same way. Asking «how do I know you're from the bank?» doesn't help either, because they have an answer ready, sometimes with your real details. The only thing that works is cutting off that channel: hang up and call the number printed on the back of your card, or the one shown inside the bank's app. If it was genuine, they'll confirm it there.

It is the final part of the script and the one that turns the scam into lost money. They tell you your account has been compromised, that someone is trying to empty it, and that to protect it the balance has to be moved to a «safe», «holding» or «custody» account while it's sorted out. Sometimes they give you an IBAN, sometimes they talk you through a Bizum or a transfer from your own app, and sometimes they ask you to withdraw cash. That account belongs to the person on the phone. No bank protects your money by asking you to take it out of your account: if it really spots a problem, it blocks transactions or cards from the inside, without you moving anything. You make the transfer, with your credentials, from your phone, and that is exactly what they want, because the transaction is then recorded as authorised by the account holder. The rule is absolute: if someone asks you to move money to protect it, it's fraud, no exceptions.

That code is your signature. The bank sends it so you can confirm a specific transaction: a payment, a transfer, a change of details or adding your card to another phone to pay with it. The caller has already started that transaction on their side, using details they got out of you earlier or harvested from a fake page, and all they're missing is the code that has just reached you. So they ask for it with an excuse: «to cancel the suspicious charge», «to verify it's you», «to stop the transfer». Read the whole text first: it often says exactly what you're authorising and adds that you shouldn't share it with anyone, including the bank. No bank employee needs you to read out a code to cancel anything. If someone asks for it by phone, WhatsApp or any other channel, hang up. Reading it out is the same as signing the transaction.

Treat it as fake. Putting a bank's logo as a WhatsApp profile picture and its name on the profile is within anyone's reach: all it takes is a new mobile number. The message usually follows the same script as the text, with a suspicious transaction, an imminent block or a pending verification, and suggests carrying on the conversation there, sending a photo of your card or ID, tapping a link or taking a call. An official-looking profile tells you nothing: what tells you a lot is your bank writing to you from a number you don't know to ask for details in a hurry. If your bank uses a messaging channel, you'll find it explained inside its app or on its official website, which you reach by typing the address yourself. If in doubt, don't reply in that chat: open the bank's app or call the number on the back of your card and ask whether that issue exists.

Call your bank immediately, on the number on the back of your card or in the app, never the one they gave you during the call. Explain that you've been the victim of impersonation, which transaction you authorised and when, and ask them to block cards and access and to try to stop or recover the transfer. There's no guarantee of getting it back, but the sooner you call, the better the chances. Then, from a device you trust, change your online banking password, and your email password too if you gave it out or typed it into a fake page. Keep the texts, the WhatsApp messages and the call log: don't delete anything, because it's your evidence. With that, report it to the Policía Nacional, the Guardia Civil or the Mossos d'Esquadra. INCIBE's 017 helpline gives free guidance on what to do next. If you also installed an app they asked you to, that phone needs checking before you use it for banking again.

Some, yes. There are rules requiring operators to filter some of the calls and texts that spoof numbers or sender names, and banks themselves warn about these scams more and more. But don't count on the filter catching everything: attackers change method as soon as one stops working, use real Spanish numbers, move to WhatsApp or combine channels. A filter reduces how many messages get through, but it doesn't change what you should do with the one that does. Besides, the scam doesn't depend on technology but on the conversation: the decisive step is always yours, reading out a code, tapping a link or making a transfer. That's why the rules are the same as years ago and still work: the bank doesn't ask for codes, passwords or for you to move money; you hang up and call the number you already had; you don't touch links in texts.

With three short sentences, written on a piece of paper next to the phone or on the fridge, because nobody remembers a long speech in the middle of the call. One: «the bank never asks for codes, passwords or for you to move money». Two: «if the bank calls, I hang up and call the number on my card». Three: «don't touch links in texts». Also explain why the message will be in the usual thread and the call will come from the usual number, because that is exactly what makes careful people hesitate. And take the embarrassment out of it: tell them you'd rather get ten calls asking whether something is normal than one transfer to an unknown account. In a business, the same applies to whoever handles payments and whoever carries the company phone: nobody authorises transactions because of an incoming call, and when in doubt, they check before doing anything.