Phishing scams? No, that's not a typo.

We recently got a question from a consumer about a scam that seems to be hitting a lot of consumers. Scott received a text from what he thought was his bank asking to confirm that he had authorized a $2,000 transfer via Zelle. Scott replied that he had not, and as soon as he did he got a phone call. The caller ID was from his bank, so he answered and got someone who claimed to be a representative of the bank. They told him that they could stop the transfer if he would open up an account at another bank and transfer money to the new account.

Based on the phone number and caller ID matching Scott’s bank, he figured this must be legit and transferred $3,500 to the new account. But as soon as he got off the phone, he realized that he had probably been the victim of a scam. So he called his bank to stop the transfer but it was too late. The bank told him that because he had legitimately authorized the $3,500 transfer, there was nothing they could do to stop it. At his wits’ end, Scott reached out to us to see if the bank held any liability for this scan that used their name and phone number to steal his money.

Unfortunately, Scott is not alone. The FTC reports that mobile app scams resulted in losses of $60 million in just the first half of 2021. The kind of scam that Scott fell victim to is called a phishing scam. The scammers “spoof” their phone number, disguising it as a trusted business or contact. Then, they send out thousands of text messages, hoping someone will “bite”. That’s why it’s called phishing.

When a potential victim replies to their text message, they know the phone number is real and active, and they already know your name. Next, the scammers spoof the phone number of the victim’s bank to follow up with a phone call. The scammers are courteous and helpful, as you might expect from a real bank. With the looming threat of a fraudulent bank transfer or other losses, victims are encouraged to act quickly and follow the scammers’ instruction to avoid further fraud or losses. Victims are pushed to provide temporary access codes, PINs, and passwords to give the scammers access to their accounts. And before the victims have a chance to stop and think clearly, their money is gone.

But let’s return to Scott’s question, is the bank liable for the fraud that was carried out using their name. Unfortunately, there is no legal liability for the bank in this case. There are a variety of laws that protect consumers who deposit their money in banks. However, in this case the bank transferred money with your genuine authorization, which is what you would want them to do in most cases. Since the bank is only doing what you told them to do, they have no legal liability.

However, just because the bank is not legally required to help you, that doesn’t mean they won’t. Banks, like any business, rely on good customer service to keep their customers. Some banks may be able to help you, though there are no guarantees. So the first thing to do in this case is talk to your bank and see what they can offer. They may still be unable to help, but if a bank treats you badly during this process, you may want to take your business elsewhere.