Bank impersonators were the costliest scam of 2025 as Americans reported losing $3.5 billion to imposters

A hacker working in a governmental IT workspace with the USA flag

Americans reported losing $3.5 billion to imposter scams in 2025, a nearly 20 percent jump from the prior year, with bank impersonators responsible for the costliest losses among all business-impersonation schemes. The Federal Trade Commission received more than 1 million imposter scam reports last year, making it the single largest fraud category, accounting for nearly one in three fraud complaints. Separately, the FBI logged more than 5,100 complaints and over $262 million in losses tied specifically to scammers posing as bank support staff to take over customer accounts.

How fake bank alerts became the most expensive fraud tactic

The FTC’s data release identified bank impersonators as the costliest business-impersonation category in 2025. The typical scheme works like this: a victim receives what looks like a security alert from their bank, often by text message or phone call. The message warns of suspicious activity and urges the recipient to act fast. Once the person responds, the scammer walks them through steps that hand over login credentials or trigger a wire transfer to an account the criminal controls.

A related pattern helps explain why these bank fakes gained traction. The FTC found that a surge in government imposter reports was tied to overdue toll text messages spoofing real toll programs. Those toll texts trained millions of Americans to expect automated payment alerts on their phones, and scammers exploited that familiarity. By mimicking the same format with a bank’s name instead of a toll authority’s, criminals lowered victim suspicion in a way that generic government impersonation could not match. The hypothesis that bank-impersonation losses grew fastest where automated toll-text volumes were highest is plausible on its face, but no primary FTC or FBI dataset currently breaks out losses by state or by the specific channel that initiated contact. The available evidence shows the mechanism, not the geography.

FBI and FTC data confirm the scale of bank-impersonation losses

Two independent federal agencies documented the damage from different angles. The FTC’s consumer data covers the broadest view: $3.5 billion in total imposter losses across more than 1 million reports in 2025, with bank impersonators driving the highest dollar losses within the business-impersonation subset. The FBI’s Internet Crime Complaint Center, tracking a narrower slice, recorded more than 5,100 complaints and losses exceeding $262 million from account takeover fraud in which criminals impersonated financial institution support staff.

The gap between those two figures reflects scope, not contradiction. The FTC counts all reported bank-impersonation fraud, including wire transfers, cryptocurrency payments, and gift cards. The FBI’s IC3 figure isolates account takeovers where scammers gained direct access to a victim’s banking credentials. Both confirm that bank impersonation is not a fringe tactic but a dominant one.

Federal enforcement and industry response

Federal enforcement has tried to keep pace with the shift toward bank-themed fraud, but officials are effectively chasing a moving target. Regulators have leaned on banks, card issuers, and payment platforms to harden authentication, roll out more conspicuous fraud warnings, and slow down high-risk transfers. Many institutions now inject pop-up notices into online banking flows, explicitly warning that bank employees will never ask customers to read off one-time passcodes or move funds to “safe” accounts.

Law enforcement has focused on the criminal infrastructure that makes these scams scalable. Investigators describe call centers that specialize in spoofing bank phone numbers, bulk text-blast services that push out millions of fake alerts, and money mule networks that launder stolen funds through a chain of accounts before cashing out. When agencies manage to seize servers or arrest ringleaders, the disruption is often temporary; copycat groups quickly adopt the same scripts and tools.

At the same time, agencies have emphasized public education as a core defense. Consumer alerts now highlight specific red flags: pressure to act immediately, instructions to bypass official bank apps or websites, and any request to provide remote access to a device. The goal is to shift the burden from spotting a perfect fake to recognizing suspicious behavior, even when the phone number or text thread appears legitimate.

How consumers can reduce their risk

While the data underscores the scale of the problem, it also points to practical steps that can blunt the damage. Security experts consistently recommend treating any unexpected bank communication as unverified, no matter how convincing it looks. Instead of tapping links or calling back numbers in a message, customers should initiate contact using the phone number printed on the back of their card or the bank’s official website or app.

People are also urged to guard one-time passcodes and multifactor authentication prompts as carefully as passwords. In many account-takeover cases, scammers do not need to hack a bank’s systems; they simply persuade the victim to read out a code or tap “approve” on a login request. If someone claiming to be from a bank asks for a code that just appeared on your phone, that is a strong signal that the call or text is fraudulent.

Finally, reporting attempts matters even when no money is lost. Both the FTC and the FBI rely on consumer complaints to spot new patterns, quantify losses, and prioritize investigations. As bank impersonation scams continue to evolve, the agencies’ own data shows that timely reporting is one of the few tools that can keep public warnings and enforcement strategies aligned with how criminals actually operate.


Free tool for readers: You check your blood pressure — when did you last check your retirement? You can get your free Retirement Safety Score in about five minutes, with no sign-up to see it.