Cyberpediaby Brain
ENDEFR

Fake bank advisor and caller ID spoofing

A fake bank advisor calls, talks about fraud and asks for a code. How to recognise the call, what to do on the spot and afterwards.

In 30 seconds

Where it happens
By a call, but also by a text message, a direct message or an email asking you to call a number back12.
What the attacker wants
To get you to give personal or financial information, or to accept an authentication request123.
The reflex
Do not call back the number that contacted you, hang up and reach the organisation by another means, with contact details found on its verified website1.
If it is already done
Tell your bank and your manager without delay (advice from this article), then report the scam4.

What it is

A call comes in from a number that looks like the bank's. The voice introduces itself as an advisor, talks about fraud under way on the account and asks you to act right away. This is a phone scam, called voice phishing: the person on the line is trying to get codes or personal information out of you13. They do not send malware directly to the victim2, but the call can also lead to downloading malware2.

This article is for an employee who receives such a call on a work or personal phone. The sources cited here describe phone phishing in general. None of them deals with spoofed numbers or with banks in particular: what the article says on those two points is therefore limited to what they allow it to state.

Straight answers

What is a fake advisor call?

MITRE ATT&CK describes voice phishing as a variant of spearphishing: the attacker pushes the victim, through a call or another voice communication, to give them access to systems2. They often pose as a trusted source and create a sense of urgency or alarm2. A fake bank advisor applies this pattern.

What does the caller want?

According to MITRE ATT&CK, phishing for information aims to gather data from the victim, often credentials or other usable details, rather than to run malicious code5. The attacker can also combine the call with multifactor authentication requests, so that the user discloses their codes or accepts a login request2.

Why should you never give out a code received by text message?

This code is the account's second lock. MITRE ATT&CK notes that one-time codes are often sent over a separate channel such as email or SMS, and that a malicious actor can intercept them if the device or service is not secured3. In the entry on bypass techniques, one group is cited for replaying stolen credentials to trigger simple approval requests, hoping the legitimate user would accept them3. A code read aloud or an approval accepted under pressure does the same job for the attacker.

Does the displayed number prove it is the bank?

The sources cited here do not describe caller number spoofing. They do show, however, that sender impersonation exists for emails: MITRE ATT&CK states that it can fool both the person and automated security tools5. The prudent rule is therefore not to treat the displayed identity as proof, and to check through another channel.

1How it works1 min

The attack relies on trust and haste. CISA notes that phishing messages often look like they come from a trusted person or organisation, in order to get a response1. Among the common signs it lists: urgent or emotional language, with serious consequences if you do not respond immediately, and requests for personal and financial information1.

The call can also be the second step. MITRE ATT&CK describes victims who receive a message inviting them to call a number, where they are then directed to a malicious address, to a download, or to the installation of a remote management tool2. One variant only aims to get people talking: the victim calls a number and the attacker tries to collect confidential information there5.

The same sources give examples outside banking, which show the method. During campaign C0027, Scattered Spider posed as IT staff on the phone to get victims to install a remote control tool2. Storm-1811 called victims while presenting itself as IT support, so that they would run scripts and other tools2. The sources do not date these cases precisely, so they are given here as examples of method and not as case files.

2What you do1 min

The principle comes from CISA: if a message looks suspicious but could be real, do not click any link and do not call any number in the message1. Look for another way to reach the organisation or the person1. For a company, this means going to its website, by searching for it in the browser or by typing the address yourself if you know it, and finding the contact details there1.

In practice, faced with a fake advisor call:

  • Hang up, even if the caller insists or claims that every minute counts. Urgency is a warning sign according to CISA1.
  • Call the bank back on the official number, taken from its verified website, never on a number given by the caller or by a message1.
  • Do not share any code received by text message and do not accept any approval that you did not trigger yourself23.
  • If the caller asks you to install a program or to take control of your computer, refuse: this is a method described by MITRE ATT&CK2.
  • Talk to your manager, especially if the call affected a work device or account.

MITRE ATT&CK lists user training among the protective measures: knowing how to spot and report social engineering, being wary of callers and checking their identity2.

3Pitfalls1 min
  • A credible appearance proves nothing. CISA specifies that a language mistake is no longer a reliable clue: in the age of artificial intelligence, some messages have perfect grammar and spelling, and you have to look for the other signs1.
  • Pressure is a common sign: CISA cites urgent language1, and MITRE ATT&CK mentions the sending of several messages that look urgent5.
  • Information published online feeds the credibility of the call. The NCSC states that criminals draw on what is available online, including on social media, to make their messages more convincing; reducing what you post and reviewing your privacy settings limits the risk4.
  • The trap of a text message that slips into an existing conversation thread is not described by any of the sources cited here. It remains prudent to treat this message like any other: do not click, do not call back the number it gives1.
4If it is already done1 min

The sources cited here do not detail how to block bank cards or accounts, or how to file a police report, so the article does not describe them. Tell your bank and your manager without delay: this is advice from this article, not a step described by the sources. CISA does give an instructive example, however, a story of email phishing and not of a call: the user ended up recovering most of their losses, at the cost of many hours on the phone with their bank and the merchant1. The CISA page also carries the notice "Archived Content" and may not reflect current policy1.

The NCSC describes reporting a scam as free and quick, and states that it helps reduce the number of fraudulent messages you receive and protect other people4. It maintains a page for reporting a suspicious call and knowing what to do if you think you have been a victim4. At the time of consultation, it announced more than 59.6 million scams reported in total, a figure as of September 20264.

Fact sheet

Identifier
CP-560
Wing
5. Office life and reflexes
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-065
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. CISA, “Recognize and Report Phishing | CISA”. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026)
  2. MITRE ATT&CK, “Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/004/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1111/ (accessed 3 November 2026)
  4. NCSC (UK), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
  5. MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)

Cite this article

Brain, “Fake bank advisor and caller ID spoofing”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/bank-impersonation-scam-caller-id-spoofing/

BibTeX 
@misc{brain_cp560_en_2026,
  author = {Brain},
  title = {Fake bank advisor and caller ID spoofing},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/bank-impersonation-scam-caller-id-spoofing/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence