Imposter scams are on the rise: Here’s how to manage the risks
As criminals impersonate trusted figures and set up fraudulent websites, education is the best defense
5 minute read
Key Takeaways
- Education is the best defense against increasingly common imposter scams where scammers may impersonate bank representatives.
- If you receive an unexpected call, text or email from someone claiming to be a relationship manager or the fraud department — even your treasury sales officer — always verify the source using contact information taken from a legitimate website, verified bill, card or statement.
- Social engineering tricks people into visiting fraudulent websites by creating false urgency and impersonating trusted organizations through convincing communications. These spoofed websites are designed to steal credentials and financial data or install malware.
- Fraudulent websites can be identified by poor design quality and incorrect domain spelling, or they may look identical to a legitimate website. Confirm you see an “https” in the website URL.
- Be proactive in coordinating a mutually understood defense with your relationship manager and treasury officer.
As our daily reliance on digital communication steadily increases, scammers are evolving their tactics to exploit the trust that financial services have built over time. Imposter scams are on the rise with consumers reportedly losing more than $12.5 billion to fraud in 2024, which represents a 25% increase from the previous year.1
Imposter scams typically begin with an anomalous email (commonly known as phishing), a phone call from a falsified number (vishing), an unsolicited text (smishing), a social media message or a malicious QR code. The communications appear to be from trusted professionals like bank representatives, lawyers or government officials.2 The perpetrators may even pose as your current relationship manager or representatives of companies you already have relationships with.
By creating fraudulent websites using legitimate information they’ve harvested from online sources, these scammers trick clients and prospects into providing confidential information with the intention of committing financial fraud.
Imposter scams are on the rise, and education is our best defense.
Scammers are impersonating bank associates and leveraging their names and photos in conjunction with fraudulent websites where they will attempt to steal your personal information.
Scammers may contact you by phone, text or email and try to trick you into providing personal information. They may also spoof a legitimate phone number to make their fictional identity seem more legitimate.
Posing as a trustworthy bank representative, a scammer will send falsified emails containing attachments with malware. Do not click suspicious links or open attachments.
If someone contacts you claiming to be a relationship manager, treasury officer or other trusted professional from Bank of America, there are clues to help you tell if the contact isn’t legitimate.
Clues a website might be fraudulent: The site asks you for your contact information—your bank will not ask for your contact information since they already have it. The site may also have grammatical errors, misspellings, awkward phrasing and poor design quality (including low-resolution images and odd layouts).
Beware: Cybercriminals have become more sophisticated, and fake websites may closely mimic legitimate ones. Be cautious of requests for personal or professional information — including employment history, prior employers, and professional credentials or certifications — especially if the request seems unusual or unsolicited.
Scammers often rely on fear to create a sense of urgency, suggesting you need to take immediate action or face financial loss, responsibility or legal consequences. Don’t feel pressured to respond immediately — this is what they want you to do.
Watch for warning signs
The best defense against imposter scams is recognizing them. Beyond awareness, here are some common red flags that can help you identify these scams before you fall victim:
- An unexpected phone call from your “relationship manager,” which might be a vishing attempt.
- An urgent request to fill out an online form. Your actual relationship manager will have reviewed forms with you during your onboarding.
- Poor website design quality, including inconsistent font, color scheme, grammar and low-resolution/missing images.
- Incorrect domain spelling and unusual top-level domains (e.g., websites ending with .zip, .cn and .xyz).
- A website domain that uses the name of the relationship manager rather than a reputable firm — always look for a legitimate website to be connected to bankofamerica.com or ml.com.
Best practices
Imposter scams are successful because of how much legitimate information scammers can mine from publicly available information on the web, allowing them to convincingly impersonate a professional or simulate a professional’s website. You can protect yourself by following these best practices:
- Verify all unusual communications, requests for payments and personal information by double checking the sender information and independently confirming the source using contact information taken from a legitimate website, verified bill, card or statement. Do not rely on the caller ID to confirm a caller’s identity!
- Make sure the URL contains “https” (the “s” in “https” stands for secure), which means the connection between your web browser and the website server is encrypted. This ensures bad actors are not eavesdropping or intercepting your communication between your browser and the website’s server. You may also find extra assurance from a “lock” icon near the URL field, depending on the browser you’re using.
- Never send payments to anyone without personally verifying their identity (via contact information taken from a legitimate website, verified bill, card or statement).
- Never give sensitive information over the phone or through a website unless you’re absolutely sure of who you’re interacting with.
- Cut off contact at any point with someone you suspect is impersonating a professional. You can always call back using a verified and trusted number.
- Immediately forward any suspicious email that uses Bank of America’s name to abuse@bankofamerica.com, then delete it.
Remember: Do not transfer money or make payments at the direction of an unexpected call or text! Also, remember that Bank of America knows who you are — we will never text, email or call you and ask you for your account authorization code.
1 New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024. Federal Trade Commission, March 10, 2025
2 “How to avoid Imposter Scams, ” FTC Consumer Advice, accessed Sept.12,2025.
Neither Bank of America nor its affiliates provide information security or information technology (IT) consulting services. This material is provided “as is,“ with no guarantee of completeness, accuracy, timeliness or of the results obtained from the use of this material, and without warranty of any kind, express or implied, including, but not limited to warranties of performance, quality and fitness for a particular purpose. This material should be regarded as general information on information security and IT considerations and is not intended to provide specific information security or IT advice nor is it any substitute for your own independent investigations. If you have questions regarding your particular IT system or information security concerns, please contact your IT or information security advisor.
