The call usually comes on an ordinary afternoon. The voice on the line sounds professional and calm. “Hello, I’m calling from your bank’s fraud department. We’ve spotted a suspicious transaction on your account, and I need to verify your identity to block it. A code has just been sent to your phone — please read it out to me.”
Everything about the call feels legitimate. The caller says your name. They know which bank you use. There is even a six-digit code arriving on your phone right now, exactly as they said there would be. And that is precisely what makes this one of the most effective scams going.
So here is the rule that ends every one of these calls, no matter how convincing the voice sounds: your bank will never call and ask for your OTP, PIN, or CVV. Never on the phone, never by text, never by email.
Why scammers ask for the code
Understanding the trick is the fastest way to become immune to it. When the “fraud department” calls you, they are not asking for your OTP just to have it. They are mid-way through an attack.
While you are on the phone, the scammer is sitting in front of your bank’s login page or payment screen, typing in your account number — which they already have, often from a previous data breach or leak. When the bank’s system sends the one-time passcode to your phone as a security check, the scammer asks you to read it out. The moment you do, they type it in, and they are in.
That is why the code arrives exactly when they said it would. It feels like proof they are from the bank. It is actually proof that someone is trying to log into your account right now, and the only thing standing between them and your money is that code on your screen.
How they sound so convincing
Modern bank scams are polished operations, not the clumsy cold calls of a decade ago. A few things worth knowing:
The caller ID can lie. It is easy to make a phone display your bank’s real number or a name like “Bank Support.” If a number looks official, treat that as decoration, not proof. The phone screen tells you nothing about who is actually calling.
They often know your name and your bank. This startles people the most. But names, phone numbers, and banking relationships circulate freely in leaked databases and bought contact lists. If your details have ever appeared in a data breach — which, realistically, many people’s have (here’s what to do when that happens) — a scammer can greet you by name and name your bank before you say a word.
They never sound like criminals. There are no threats shouted down the line, no broken English, no background noise from a boiler room. The whole routine is designed to sound like a routine security check, because the calmer you feel, the more likely you are to cooperate.
The warning signs that give it away
Even a smooth operation leaves fingerprints. Watch for any of these:
- Urgency. “We need to do this right now or the transaction will go through.” Real banks don’t threaten you with instant consequences if you don’t act this second.
- Asking for anything secret. OTPs, PINs, CVVs, passwords, “the first four digits of your PIN,” screen-sharing your phone — any request for something only you should know is the line no real bank crosses.
- Telling you not to tell anyone. “This is a confidential investigation — please don’t hang up.” This is the scammer keeping you on the line so you don’t check with anyone else.
- Asking you to move money to a “safe account.” Banks never ask you to transfer funds to a new account for safety. Any version of this is fraud, full stop.
- Asking you to call them back on their number. Even “calling back” is unsafe if you dial the number they gave you. Only use a number you find yourself — on your card, in the official app, or on the bank’s real website.
What to do when you’re on the call
The instructions are mercifully short: hang up. You don’t owe the caller an explanation, a polite goodbye, or even the thirty seconds it takes to check whether they’re real. Nobody legitimate will ever punish you for hanging up and calling back through the official channel.
Then, if you are genuinely worried something is wrong with your account, look up your bank’s number yourself — the number printed on your card, inside the official mobile app, or on the bank’s own website that you navigate to directly — and call them. If there really is suspicious activity, you will find out from the actual bank, on a call you initiated.
Never use a number, link, or callback option that came from the unsolicited message itself. That is the single most reliable habit you can build: the person who contacts you sets the terms; you set the channel.
Already shared the code? Move fast
If you read out an OTP or shared a PIN before realising what was happening, don’t freeze up — speed is your best defence now. Call your bank immediately on the number on your card and tell them you may have been scammed. They can lock the card, freeze the session, and walk you through reversing unauthorised activity.
Then check your account for transactions you didn’t make, and change your online banking password. If that password was the same one you use for your email, fix that too — your email account is the master key to everything else, and a leaked banking password is not something to leave floating around.
Consider reporting the attempt as well. Most banks have a fraud-reporting channel, and national reporting portals exist for exactly this. Reports help investigators track patterns, and they cost you about five minutes.
The habit worth keeping
Memorise this as a reflex rather than a rule you have to think about: any unexpected call that wants your codes, passwords, or card details is a scam. You don’t need to identify which scam, or win an argument with the caller, or feel embarrassed about falling for the first half of it. Hang up, call your bank yourself, and carry on with your day. The scammers are counting on the call being too convincing for that — prove them wrong.
