Hang up and call your bank back using the number on the back of your card or on the bank's official website. This is the single most important step, because scammers can fake caller ID to show your real bank's name and number, and they rely on urgency and fear to keep you on the phone before you think clearly. A legitimate fraud department will never object to you calling back through a verified number.
Real bank fraud teams typically only confirm whether a specific transaction was made by you. They do not ask you to read back a one-time passcode, move money to a "safe account," buy gift cards, or give your full password or PIN. If the caller asks for any of these things, or pressures you to act immediately without hanging up, that is a strong sign of a scam, regardless of how official they sound or how much personal information they already seem to know about you.
Scammers often have pieces of real information, such as your name, address, or the last four digits of your card, pulled from data breaches or public records. Having some accurate details does not prove the caller is legitimate. Treat any unsolicited call about your accounts as unverified until you confirm it yourself.
If you already gave out a one-time code, your password, or made a transfer before realizing something was wrong, contact your bank immediately through the official number, explain what happened, and ask them to freeze the account and reverse any transactions. Also change your online banking password and enable two-factor authentication if you haven't already, since the scammer may try to log in directly.
While on the phone with a suspicious caller, resist any pressure to stay on the line while you "verify" something through another channel, such as opening your banking app. Scammers sometimes ask victims to do this precisely so they can intercept or influence what happens next. The safest move is always to end the call entirely, then separately look up and dial the bank yourself.
It also helps to know your bank's normal practices in advance. Most banks will tell you they will never call and ask for your full PIN, password, or a one-time passcode sent to your phone. Knowing this ahead of time makes it much easier to recognize a scam in the moment instead of being caught off guard.
After the call, consider reporting it. You can tell your bank about the attempted scam so they can flag the number or pattern, and you can file a report with the Federal Trade Commission at ReportFraud.ftc.gov. If money was taken, report it to local police as well, since some banks and insurers require a police report for fraud claims.
Finally, keep an eye on your accounts for a few weeks afterward. Set up transaction alerts if you haven't already, and check statements closely. If a scammer got enough information to attempt identity theft, not just account fraud, consider placing a fraud alert or credit freeze with the major credit bureaus.