How to Avoid Falling for a Bank Imposter Scam
March 12, 2026
Imposter scams come in many forms, but one that is becoming more frequent and more sophisticated is where a scammer impersonates your bank or credit union to try to gain access to your money.
How It Works
- You get a text that looks like a fraud alert from your bank or credit union. The text references a small charge on your card and asks you to respond yes or no to whether it’s a legitimate transaction. If you respond, the scammer knows they’ve got your attention.
- Moments later, you get a phone call. The caller ID shows your bank’s name and correct phone number, but it’s actually the scammer spoofing that information. If you answer, the person may be very calm and reassuring. They may even know some information about you and follow your bank’s actual procedures, making you believe they really are from your financial institution.
- The scammer triggers a legitimate two-factor authentication text or email from your bank. It’s the same one you receive when you’re logging in to your account. The scammer tells you it’s standard procedure and asks you to read the security code number back to them so they can verify your identity.
- The security code gives the scammer access to your account, and they start making transfers or wires quickly. In just a few days, they can make many small or several large transfers and empty your funds.
How to Protect Yourself
-
Ignore unexpected texts or emails from your financial institution. Do not reply or click any links. If you’re worried it may be a legitimate fraud alert, call your credit union or bank directly at the number on the back of your debit or credit card.
- Do not trust Caller ID, even if it shows the correct name of your bank/credit union. Just don’t answer the call. Scammers are pros at manipulating Caller ID systems to show the information they want displayed.
- Never share verification or security codes.* No one from RCU or any other financial institution will ever contact you to ask for this information. If they do, hang up immediately.
- Get your financial institution’s phone number from the back of your card or from their official website or mobile app, not from search results. Fraudsters can purchase ad space in search results to impersonate businesses. And, make sure you type the website URL yourself. Don’t use a link.
- Set up alerts in digital banking to help you monitor and manage your money. RCU provides many different alerts to choose from, including login, transaction, and transfer alerts to name a few. Learn how to set up, edit, and remove alerts.
Most Important Takeaway
*Remember: Scammers don’t need your password or PIN to get into your banking account. All they need is that security code.
If you have questions or think you may have been a victim of fraud, please report it to RCU’s Fraud Team at 1 (800) 479‑7928 or contact us directly through our website.
PPP Forgiveness Application Deadline
Congress passed The Economic Aid Act which changed the deferment period from 6 months post covered period to 10 months post covered period. For example, if your covered period ended June 30, 2021, under the new guidelines the earliest your first loan payment wouldn’t be due until April 2022, and you have until then to request forgiveness. Please use the following calculation to help you identify when your forgiveness will be due:
- PPP borrowers may select a covered period anywhere from 8 weeks to 24 weeks.
- RCU is automatically calculating your loan due date based on a 24-week covered period, if you intend on using a shorter covered period please inform us immediately as this will impact your due date.
- Your correct deadline will be reflected in your online banking account.
If all or part of your PPP loan is not forgiven, your first loan payment will be due the first of the following month after a decision is made by the SBA.
Leaving Our Website
You are leaving our website and linking to an alternative website not operated by us. Redwood Credit Union does not endorse or guarantee the products, information, or recommendations provided by third-party vendors or third-party linked sites.
