Table of Contents
The FBI’s Internet Crime Complaint Center recorded $12.5 billion in reported fraud losses in 2023, a 22% jump on the year before. The detail buried in that figure matters more than the headline: in most cases the victim authorized the payment. No firewall was breached. Someone answered a text, read a number off a card, or approved a transfer because a voice on the phone sounded like their bank’s fraud team.
That is the shape of modern bank fraud. Your bank’s own defenses are decent. The weak point is the space between your phone and your account, and the person holding the phone. Here’s how to close it.
Ten minutes of settings that stop most attempts
Before worrying about sophisticated scams, fix the front door. These changes take one sitting and block the bulk of opportunistic fraud.
- Change the PIN your bank gave you. Four digits chosen by a computer are easy to guess or shoulder-surf. Pick six where the bank allows it, and never use a birth year.
- Give every financial account a unique password. If your bank password matches the one you used on a breached shopping site, credential-stuffing bots will find it. A password manager solves this in an afternoon.
- Turn on two-factor authentication, then check which kind. Text message codes are the weakest option. App-based codes or a hardware key are stronger.
- Switch on the card lock in your banking app. Most major banks let you freeze a debit card instantly from your phone. Practise it once now so you’re not fumbling at 2am.
Why SMS codes are the weak link
SIM swapping is not exotic. A fraudster walks into a phone shop with a fake ID, convinces staff to port your number to a new SIM, and every one-time code your bank sends now lands on their handset. Call your mobile carrier and ask for a port-out PIN or account lock. It takes five minutes and closes a route that costs victims millions each year.
Alerts are worth nothing if they arrive a day late
Log into your banking app and look at notification settings. You want a push alert for every transaction over a small amount, not a weekly digest. Turn on alerts for international transactions, online purchases, and any payment where the card wasn’t physically present. A $3.99 test charge at 3am is often a criminal checking whether the card works before they spend properly.
Balance alerts matter too. A low-balance warning that fires at $50 gives you a chance to notice a drain in progress rather than discovering it on payday.
Reading the phishing script before it reads you
Most bank impersonation follows a predictable arc: a hook (unusual activity, a locked account, a delivery), a reason you can’t hang up and verify, then a request that moves the conversation somewhere less traceable. Common tells:
- The message comes from a number or address you can’t verify, and the link goes somewhere that isn’t your bank’s real domain.
- They manufacture urgency. Genuine fraud teams do not tell you to act within ten minutes or lose your savings.
- They ask for a code. No bank needs the six-digit code it just sent you. Anyone asking for it is the fraudster.
- They want money moved to a “safe account”. There is no safe account. This is the biggest red flag in bank scams on both sides of the Atlantic.
If a call feels wrong, hang up and ring the number printed on the back of your card. Use a different phone if you can, because some scammers keep the line open.
The payments with no undo button
Losses cluster around payment types that settle instantly and can’t be clawed back. Peer-to-peer transfers like Zelle, Cash App and Venmo are built to be irreversible, which is exactly why scammers push you toward them. Wires are worse: once the money hits the receiving account, recovery depends on the recipient bank’s goodwill and how fast you call.
Gift cards sit at the bottom of the ladder. No legitimate business, government agency or bank takes payment in Apple or Google Play cards.
Thieves went back to stealing paper
Check fraud climbed sharply after 2020, and it starts at your mailbox. A stolen cheque gets washed with household chemicals to erase the name and amount, then rewritten for a new payee.
The fixes are unglamorous. Use a locking mailbox or a post office drop box. Don’t leave outgoing cheques in your home mailbox with the flag up. Use gel pens, which bleed into the paper fibers and make washing harder. Better still, pay electronically wherever the recipient allows it.
When money has already moved
Call your bank’s fraud line immediately, change your passwords from a device you trust, and report it to the FTC at IdentityTheft.gov. If the bank freezes the account while it investigates, that is normal and often a good sign, though it can leave you without cash for days. There’s a useful walkthrough of what to do when your bank freezes your account, including which documents speed up the review.
The 60-day clock that decides who pays
US law protects you, but the protection has expiry dates. Under Regulation E, which covers debit cards and electronic transfers:
- Report a lost or stolen card before it’s used and your liability is $50.
- Report within two business days of noticing and you’re still capped at $50.
- Wait longer than two days but file within 60 days of the statement date and liability can reach $500.
- Miss the 60-day window and you may have no legal right to a refund at all.
Put it in your calendar: check your statement the day it lands, and dispute anything unfamiliar in writing. Verbal reports are fine, but a dated written notice creates a paper trail banks take seriously.
Choose an account that fights back
Not every bank gives you the same tools. Some offer instant card freezes, granular spending controls and same-day dispute handling; others make you phone a call center during business hours. If yours is the second kind, compare what else is out there, starting with these best checking accounts for fraud protection and low fees. App-only banks often ship stronger real-time controls, though branch access matters when something goes badly wrong, a trade-off covered in this comparison of online banks versus traditional banks.
If the account itself has been compromised beyond repair, moving on is sometimes cleaner than rebuilding trust. Here’s how to close a bank account without triggering surprise fees, including the direct debits people forget to redirect.
One habit worth building this week: keep the account you pay bills from separate from the one linked to your debit card and shopping apps. A compromised card then exposes a few hundred dollars rather than your rent money. Boring, effective, and it costs nothing to set up.
