A sheriff’s office in Florida warned residents this month about a phone call that looks like it comes from your bank. I have had such a call. I appeared to come, by the Caller ID, from my bank’s helpline number. Police in Ohio warned about scammers showing up at people’s doors. Police in Texas warned about calls where a criminal uses a cloned voice to convince a parent their child has been kidnapped.
These are not three separate problems. They are three costumes worn by the same attack - the impersonation scam - and the people running it have gotten better at it than most of us have gotten at spotting it.
The good news: every version of this scam breaks against the same wall. There is one question that stops every script, and three rules that cover every variant. Let me show you the three scams you are most likely to meet, what they sound like, and how to break them.
Scam 1: The Call From “Your Bank” That Ends at Your Door
This is the one doing the most damage right now. The FBI’s Internet Crime Complaint Center received around 300,000 reports of bank impersonation in 2025 alone - making it the most reported consumer fraud category in the country.
Here is how it runs.
Step one: the call. You get a call from what looks like your bank’s number - the actual number, thanks to caller ID spoofing. The caller says your account has been compromised. They are calling from the “fraud department.” They already know your name, your address, and sometimes the last four digits of your account. That is why it feels real: they did their homework.
Step two: the cover story. They tell you the “fraud investigator” needs your help to catch the criminal. They give you a story to tell the bank teller or the customer service rep, so nobody flags the transaction. Sometimes they tell you to say you are buying a car or paying for a surgery. Sometimes they tell you to lie about why you are withdrawing the money.
Step three: the courier. In the newest version - the one police in Ohio and Florida have both warned about it this month - someone knocks on your door. They say they are a bank courier, here to collect your card, your cash, or your PIN so the “investigators” can run their trap. They may even look the part.
Here is the sentence that should end the whole conversation: no real bank or police force will ever send someone to your door to collect your card, your cash, or your PIN. Never. Not once. Banks have branches, forms, and fraud departments. They do not need a courier to come take your ATM card.
And one more rule that covers the whole family: anyone who tells you to lie to bank staff is a scammer. A real bank will never instruct you to deceive their own employees. That instruction is the tell.
Scam 2: The Family Emergency With Your Child’s Voice
The scariest version uses technology most people still think belongs in science fiction: AI voice cloning.
Here is how it works. A criminal finds a short recording of your loved one’s voice - a social media video, a voicemail greeting, anything. Software turns a few seconds of audio into a working copy of that voice. Then the call comes: “Mom, I’m in jail. I need bail. Please.” Or the hostage version: “We have your daughter. Pay us or she dies.” It sounds exactly like them, because it is exactly their voice.
This is not hypothetical. Police in Beaumont, Texas have warned about AI-cloned hostage calls this year. The FBI reported that Americans lost close to a billion dollars to this family of scams in a single year - most of it in the last few months, as the cloning tools got cheap enough for anyone to use.
The defense is absurdly simple, and it is the one thing the criminals cannot clone: agree on a safe word with your family now. Pick a word nobody outside the family would guess. Make it something boring - the name of a childhood pet, the street you grew up on, a shared inside joke. The rule: if someone calls and asks for money, you ask for the safe word first. No word, no conversation. A real relative knows it. A scammer with a cloned voice does not.
If you have not set up a safe word, use the backup test: ask a question only the real person could answer. “What did we have for dinner on my birthday?” “What is the name of your first teacher?” A clone has the voice. It does not have the memories.
Scam 3: The Text That Steals Your Account
Not every scam needs a human voice. The quietest version arrives as a text message - “smishing,” the text-message cousin of phishing.
The message pretends to be from a bank, a delivery service, or a government agency. “Your package is waiting, click here to reschedule.” “Unusual activity detected on your account, verify now.” “Your payment was declined, update your details.” The link goes to a page that looks exactly like the real thing. You type in your login, your card number, or your personal details - and they are gone.
The giveaway is the urgency. Real companies send texts that say “your package will be delivered Tuesday.” Scammers send texts that say “ACT NOW or your account will be closed.” The threat is the tell: they need you to act before you think.
Two habits kill smishing:
Habit one: never tap the link. If a text claims to be from a company you use, go to the company’s app or website yourself - type the address or use a bookmark you already have. If there really is a problem, it will be waiting for you there.
Habit two: forward the text to 7726. That is the industry’s spam-reporting number - SPAM on your keypad. Forwarding the message tells your carrier about the scam and helps block it for everyone. It takes five seconds and it costs nothing.
The One Question That Breaks Every Script
Here is the wall every impersonation scam hits - the one question that ends the conversation no matter which costume the scammer is wearing:
“What is the number on the back of my card?”
Your bank knows the number on the back of your card. It printed it. The “fraud investigator” on the phone does not - because the call is the crime, and they never actually had your card. A real bank representative can answer instantly. A scammer has to improvise, stall, or hang up.
If the caller cannot answer, you hang up and call the number on the back of your card yourself - not the number they gave you, not the number on the caller ID. The number on the card is the only one that is real.
The Three Rules, In One Place
- Hang up and call back on the number on the back of your card. Never verify anything with someone who called you. This is the rule from The Hack That Wiped a Man’s Baby Photos - Lesson 5, “the support call is the attack.” Same attack, new costumes.
- No real bank or police force sends anyone to your door. For your card, your cash, or your PIN - never, under any circumstances. And anyone who tells you to lie to bank staff is a scammer, full stop.
- Agree on a safe word with your family. Before anyone needs it. The one thing a cloned voice cannot clone.
The other two habits - never tap the link in a text, and forward spam to 7726 - are the same idea applied to your phone.
Why This Matters More Than Ever
Scammers are not getting smarter about their targets. They are getting better at their costumes. The voice is cloned. The caller ID is real. The text looks official. The person at the door looks like they belong.
But the attack underneath never changed. It is still someone trying to get you to act on their say-so, fast, before you check. And it still breaks the same way: slow down, verify through your own channel, and remember that the people who do this for a living are counting on you being too polite, too rushed, or too scared to ask the one question.
A real bank is never offended when you hang up and call back. A real relative knows the safe word. A real company can wait while you check. The scammer is the only one who needs you to stay on the line.
So ask the question. Then call the number on the back of the card.
And if you want the deeper layer - how the accounts themselves get broken into even without a phone call - the story of the hack that wiped a man’s baby photos is the best five lessons you will read this year. For the network side of the same problem, Home Network Security - What Actually Matters covers the router and device layer.
This is the first article in the Scam Awareness series. More coming - if there is a scam you keep hearing about and want explained, let me know and I will write it up.