--- id: CP-560 slug: bank-impersonation-scam-caller-id-spoofing lang: en title: Fake bank advisor and caller ID spoofing description: A fake bank advisor calls, talks about fraud and asks for a code. How to recognise the call, what to do on the spot and afterwards. canonical_url: https://startbrain.io/cyberpedia/en/articles/bank-impersonation-scam-caller-id-spoofing/ markdown_url: https://startbrain.io/cyberpedia/en/articles/bank-impersonation-scam-caller-id-spoofing.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Fake bank advisor and caller ID spoofing", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/bank-impersonation-scam-caller-id-spoofing/ (CC BY 4.0) wing: 5 theme: outsmart_social_engineering reflex: cr-065 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/bank-impersonation-scam-caller-id-spoofing/ fr: https://startbrain.io/cyberpedia/fr/articles/faux-conseiller-bancaire-spoofing-numero/ de: https://startbrain.io/cyberpedia/de/articles/falscher-bankberater-rufnummernfaelschung/ es: https://startbrain.io/cyberpedia/es/articles/falso-asesor-bancario-suplantacion-numero/ sources: - "n": 1 title: Recognize and Report Phishing | CISA publisher: CISA url: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing accessed: "2026-11-03" - "n": 2 title: "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/004/ accessed: "2026-11-03" - "n": 3 title: Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1111/ accessed: "2026-11-03" - "n": 4 title: "Phishing scams: how to spot and report them" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/phishing-scams published: "2021-11-26" accessed: "2026-11-03" - "n": 5 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" --- # Fake bank advisor and caller ID spoofing A call comes in from a number that looks like the bank's. The voice introduces itself as an advisor, talks about fraud under way on the account and asks you to act right away. This is a phone scam, called voice phishing: the person on the line is trying to get codes or personal information out of you [1][3]. They do not send malware directly to the victim [2], but the call can also lead to downloading malware [2]. This article is for an employee who receives such a call on a work or personal phone. The sources cited here describe phone phishing in general. None of them deals with spoofed numbers or with banks in particular: what the article says on those two points is therefore limited to what they allow it to state. ## In 30 seconds - Where it happens: by a call, but also by a text message, a direct message or an email asking you to call a number back [1][2]. - What the attacker wants: to get you to give personal or financial information, or to accept an authentication request [1][2][3]. - The reflex: do not call back the number that contacted you, hang up and reach the organisation by another means, with contact details found on its verified website [1]. - If it is already done: tell your bank and your manager without delay (advice from this article), then report the scam [4]. ## Straight answers ### What is a fake advisor call? MITRE ATT&CK describes voice phishing as a variant of spearphishing: the attacker pushes the victim, through a call or another voice communication, to give them access to systems [2]. They often pose as a trusted source and create a sense of urgency or alarm [2]. A fake bank advisor applies this pattern. ### What does the caller want? According to MITRE ATT&CK, phishing for information aims to gather data from the victim, often credentials or other usable details, rather than to run malicious code [5]. The attacker can also combine the call with multifactor authentication requests, so that the user discloses their codes or accepts a login request [2]. ### Why should you never give out a code received by text message? This code is the account's second lock. MITRE ATT&CK notes that one-time codes are often sent over a separate channel such as email or SMS, and that a malicious actor can intercept them if the device or service is not secured [3]. In the entry on bypass techniques, one group is cited for replaying stolen credentials to trigger simple approval requests, hoping the legitimate user would accept them [3]. A code read aloud or an approval accepted under pressure does the same job for the attacker. ### Does the displayed number prove it is the bank? The sources cited here do not describe caller number spoofing. They do show, however, that sender impersonation exists for emails: MITRE ATT&CK states that it can fool both the person and automated security tools [5]. The prudent rule is therefore not to treat the displayed identity as proof, and to check through another channel. ## How it works The attack relies on trust and haste. CISA notes that phishing messages often look like they come from a trusted person or organisation, in order to get a response [1]. Among the common signs it lists: urgent or emotional language, with serious consequences if you do not respond immediately, and requests for personal and financial information [1]. The call can also be the second step. MITRE ATT&CK describes victims who receive a message inviting them to call a number, where they are then directed to a malicious address, to a download, or to the installation of a remote management tool [2]. One variant only aims to get people talking: the victim calls a number and the attacker tries to collect confidential information there [5]. The same sources give examples outside banking, which show the method. During campaign C0027, Scattered Spider posed as IT staff on the phone to get victims to install a remote control tool [2]. Storm-1811 called victims while presenting itself as IT support, so that they would run scripts and other tools [2]. The sources do not date these cases precisely, so they are given here as examples of method and not as case files. ## What you do The principle comes from CISA: if a message looks suspicious but could be real, do not click any link and do not call any number in the message [1]. Look for another way to reach the organisation or the person [1]. For a company, this means going to its website, by searching for it in the browser or by typing the address yourself if you know it, and finding the contact details there [1]. In practice, faced with a fake advisor call: - Hang up, even if the caller insists or claims that every minute counts. Urgency is a warning sign according to CISA [1]. - Call the bank back on the official number, taken from its verified website, never on a number given by the caller or by a message [1]. - Do not share any code received by text message and do not accept any approval that you did not trigger yourself [2][3]. - If the caller asks you to install a program or to take control of your computer, refuse: this is a method described by MITRE ATT&CK [2]. - Talk to your manager, especially if the call affected a work device or account. MITRE ATT&CK lists user training among the protective measures: knowing how to spot and report social engineering, being wary of callers and checking their identity [2]. ## Pitfalls - A credible appearance proves nothing. CISA specifies that a language mistake is no longer a reliable clue: in the age of artificial intelligence, some messages have perfect grammar and spelling, and you have to look for the other signs [1]. - Pressure is a common sign: CISA cites urgent language [1], and MITRE ATT&CK mentions the sending of several messages that look urgent [5]. - Information published online feeds the credibility of the call. The NCSC states that criminals draw on what is available online, including on social media, to make their messages more convincing; reducing what you post and reviewing your privacy settings limits the risk [4]. - The trap of a text message that slips into an existing conversation thread is not described by any of the sources cited here. It remains prudent to treat this message like any other: do not click, do not call back the number it gives [1]. ## If it is already done The sources cited here do not detail how to block bank cards or accounts, or how to file a police report, so the article does not describe them. Tell your bank and your manager without delay: this is advice from this article, not a step described by the sources. CISA does give an instructive example, however, a story of email phishing and not of a call: the user ended up recovering most of their losses, at the cost of many hours on the phone with their bank and the merchant [1]. The CISA page also carries the notice "Archived Content" and may not reflect current policy [1]. The NCSC describes reporting a scam as free and quick, and states that it helps reduce the number of fraudulent messages you receive and protect other people [4]. It maintains a page for reporting a suspicious call and knowing what to do if you think you have been a victim [4]. At the time of consultation, it announced more than 59.6 million scams reported in total, a figure as of September 2026 [4]. ## Sources 1. CISA, "Recognize and Report Phishing | CISA". https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/004/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1111/ (accessed 3 November 2026) 4. NCSC (UK), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026) 5. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/bank-impersonation-scam-caller-id-spoofing/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.