The Biggest Shift in Fraud: Scammers Don't Need to Steal Your Information—They Can Convince You to Give It to Them
Fraud Is Getting More Personal
Fraud used to be easier to recognize. A suspicious charge on your debit card or an email with obvious spelling mistakes could be a clear warning sign.
Today, scammers are getting more sophisticated. Instead of simply trying to steal your card number or password, they may try to convince you to hand over access to your money yourself.
The FBI has warned about a growing form of account takeover fraud in which criminals impersonate financial institution employees or support representatives. Since January 2025, the FBI received more than 5,100 reports of this type of fraud, with reported losses exceeding $262 million1.
The approach is simple—but effective:
Impersonation + urgency + social engineering = an opportunity for fraud.
How the Scam Works
Imagine receiving a text saying there has been suspicious activity on your account.
A few minutes later, you receive a phone call from someone claiming to be from your financial institution's fraud department. They know your name and may even know some information about your account.
They tell you your money is at risk and that they need to "secure" your account.
Then they ask for your password, a one-time verification code or other information.
It may sound legitimate. That's the point.
The scammer isn't necessarily trying to break through your financial institution's security. They're trying to convince you to bypass it for them.
Criminals can also use fraudulent websites, search-engine advertisements, emails and text messages to capture login credentials before contacting victims directly.
A One-Time Code Is Still Your Code
One of the most important things to remember:
Never share a one-time verification code with someone who contacts you unexpectedly.
A legitimate financial institution will not ask you to provide a security code so they can "protect" your account.
If someone asks for your password, PIN or verification code, stop the conversation and contact your financial institution using a trusted phone number or the official website.
Don't Trust Caller ID
A phone call can appear to come from a legitimate business—even when it doesn't.
Scammers can impersonate financial institutions and customer-support representatives, creating a convincing story designed to make you act quickly.
If you're unsure, hang up.
Then contact your financial institution directly using the phone number on the back of your debit or credit card or another trusted source.
Don't call the number the suspicious caller gives you.
Slow Down When Someone Creates Urgency
Scammers want you to react before you have time to think.
Watch for messages such as:
- "Your account has been compromised."
- "You need to move your money immediately."
- "Your account will be closed."
- "Give me this code so I can stop the transaction."
- "Don't hang up."
- "Don't tell anyone."
These are warning signs.
When money is involved, slowing down is a powerful form of protection.
Protect Yourself
You don't need to become a cybersecurity expert to make it harder for scammers to reach your money.
Stop.
Don't click unexpected links, provide sensitive information or transfer money because someone contacted you unexpectedly.
Verify.
Contact the company or financial institution directly using a trusted phone number or website. The FBI recommends using bookmarks or favorites to access financial websites rather than clicking on search advertisements or unfamiliar links1.
Protect.
Use strong, unique passwords and multi-factor authentication, and regularly monitor your accounts for unusual activity.
If You Think You've Been Scammed
Act quickly.
Contact your financial institution immediately and explain what happened. If you provided login information, change your passwords and secure your accounts. If you sent money, ask your financial institution whether the transaction can be recalled or reversed.
Keep copies of suspicious texts, emails, phone numbers and transaction information. These details may be useful when reporting the incident.
Your Best Defense? Take Your Time.
The most important shift in fraud isn't just that scammers have better technology.
They're getting better at pretending to be people you trust.
A phone call from your financial institution. A text about your account. A message from someone you know.
When something feels urgent, remember: stop, verify and protect.
Taking an extra minute before responding could help protect your money, your information and your financial wellbeing.
Affinity Federal Credit Union will never ask you to provide your password, PIN or one-time verification code in response to an unsolicited call, text or email. If you receive a suspicious communication appearing to be from Affinity, contact us directly through a trusted channel.
1 Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), “Account Takeover Fraud via Impersonation of Financial Institution Support,” November 25, 2025.