
Your phone rings. The caller says they’re from your bank and that there has been suspicious activity on your account. They sound official. They use the right terms. Then they add pressure: you need to act now to protect your money.
In that moment, it’s normal to feel torn. There is a part of you that wants to be cautious. Another part of you wants to fix it before anything gets worse, especially when the caller sounds believable. Your next move is critical.
This guide will show you the mistakes to avoid, the safer steps to take instead, and a few simple habits that can help you stay protected long after the call ends.
The safest way to respond
When a call is unexpected, don’t try to figure out whether the person is real while you’re on the phone. Use one quick gut-check instead:
Would my bank ever ask me that?
Remember that if the request involves your password, PIN, full online banking login or a one-time passcode, banks never ask that.

What you shouldn’t do: Treat the caller like they’ve already been verified
When you get an unexpected call, it’s easy to slip into “customer service mode” and answer questions without thinking. Scammers count on that. They’ll ask for information that sounds routine, then use it to try to get access.
Be cautious if an unexpected caller asks for any of these:
- Your password or online banking login
- A one-time code sent by text or email
- Your PIN
- Your full card number or the security code on your card
- Answers to security questions
- Personal details that could be used to impersonate you
If you’re thinking, “They already know my name, so maybe it’s real,” pause. Names and phone numbers can be found easily. Your job is to protect the details that unlock accounts.
What you shouldn’t do: Stay on the phone while they coach you through steps
A common scam tactic is to keep you on the phone long enough to guide you into doing something you wouldn’t normally do. That might include logging in while they listen, reading a passcode out loud, or approving a prompt on your phone.
If a caller wants you to take actions in real time, especially actions related to account access or money movement, that’s a reason to slow down.
Here’s a script that works without sounding dramatic:
“I don’t share account details on incoming calls. I’m going to hang up and contact the bank directly.”
If the person gets pushy, tries to keep you talking or acts offended when you say you’ll call back, that’s an indicator you may be talking to a scammer.
What you shouldn’t do: Trust caller ID or a familiar looking number
Caller ID can be misleading. A call can appear to come from a legit organization even when it doesn’t. A number matching isn’t proof.
Instead of trying to decide on the legitimacy of the caller, switch to a step you control: contact the bank using a phone number you trust or a
verified contact page.
What to do instead: A quick response that keeps you safe
If you get a call from someone claiming to be your bank, do this:
- Hang up. You don’t need to argue or explain yourself.
- Call back using a trusted number. Use the number on the back of your card, bank statement or the bank’s official contact options.
- Check your account using the method you normally use. Open your banking app or type the bank’s website address yourself. Avoid clicking links sent during or after the call.
- Report it if it felt suspicious. Even if you didn’t share anything, reporting helps your bank understand what happened and can help stop the next attempt.

Red flags that should end the call immediately
End the call and verify independently if the person:
- Asks for a password, PIN or one-time passcode
- Tells you to move money to a “safe” account
- Pressures you to stay on the phone while you log in
- Sends a link and insists you click it right now
- Gets annoyed when you say you’ll call back using a trusted number
Scams often work because they replace your normal habits with “special or urgent instructions.” Don’t follow these instructions from an unverified caller.
If you already shared information, do this next
If you shared a passcode, password, PIN or other sensitive information, don’t waste time replaying it in your head. Focus on the next steps.
- Contact your bank right away using a trusted number or an official contact page
- Change your online banking password using your bank’s official app or website
- Review recent activity and report anything you don’t recognize
- Watch for follow-up attempts since scammers often try again
Moving quickly can help limit the impact and reduce the risk of ongoing fraud tied to identity theft.
Small habits that support stronger fraud protection
Phone scams get attention because they feel personal, but daily habits help protect money from many types of fraud.
Pay attention to check activity
Even if you don’t write checks often, check fraud still happens. Criminals may steal checks, alter them or use counterfeit versions. If checks are part of your personal finances or your business, BankUnited’s
9 essential tips for preventing check fraud is a practical resource to keep handy and share with anyone on your team who handles outgoing payments.
Slow down when someone changes payment instructions
A classic scam is a message that looks like it came from a vendor or partner asking you to send the next payment to a new account. Don’t rely on the phone number or email address inside the message. Verify using contact information you already trust.
Review account activity regularly
You don’t need to watch every transaction. A quick routine check helps you spot the charge that doesn’t fit. The sooner you catch something, the easier it is to fix so consistency matters.
For business owners: Make it harder for fraud to get traction
Fraud attempts don’t only target individuals. Businesses get hit too, often through employees, vendors and payment workflows. The goal is usually the same: get someone to approve a payment or share access.
Two changes make a real difference because they’re easy to follow.
Put a simple policy in writing
A written policy doesn’t have to be long. It just needs to be clear enough that people know what to do when something feels off.

Use controls that match how you move money
Most financial institutions offer commercial fraud tools to help businesses minimize risk, but the most effective strategy depends on your specific workflow—how you initiate payments, receive funds, and manage user access. BankUnited’s Fraud Prevention Services provide a comprehensive starting point by combining education with high-tech, actionable safeguards:
- ACH & Check Monitoring: Tools like ACH Alerts provide real-time notifications with full "pay or return" control. For check transactions, Positive Pay and Payee Positive Pay systematically match issued checks against those presented for payment to catch discrepancies in amounts or payee names before money leaves your account.
- Online Security: Enhance your fraud protection with robust access controls, including token authentication and dual-control requirements for sensitive transactions.
Red Flags and Reminders
Scam calls work when they make you feel like you must act immediately to satisfy the caller. Remember this simple fact: You don’t have to.
When an incoming caller asks for sensitive details, ask yourself: Would my bank ever need to ask me that?
Treat all unexpected requests for private information as a stop sign, and you'll avoid a large share of common scams.
If you have questions or want to report a suspicious call,
get in touch with BankUnited.
This guide is provided for informational purposes only and is intended to help customers better understand common fraud schemes and general prevention practices. While the Bank works to maintain safeguards designed to help protect customer accounts and information, no security measures can eliminate all risk of fraud, and the Bank does not guarantee that the practices described in this guide will prevent fraud. Fraud schemes and cybersecurity threats continually evolve, and the examples described in this guide may not reflect all current or emerging risks.