The fake bank security call draining New Zealand accounts

Your phone displays your bank's real name and number. The caller knows your full name, your address, and the last digits of your card. Speaking with the calm urgency of a fraud analyst, they explain that a suspicious transfer is processing right now — and only immediate action will stop it. This is the fake bank security call, one of the most damaging scams in New Zealand, and every authentic-seeming detail is engineered to make you stop thinking and start obeying.

The script, step by step

Bank impersonation follows a reliable playbook. Recognising the sequence is your best defence:

1. The hook. An automated message or live caller warns of suspicious activity — a transfer, a login from overseas, a purchase you never made. The details are kept plausible but vague.
2. The reassurance. The caller "verifies" you by reading back personal details — your name, address, card digits — harvested from data breaches or earlier phishing, not proof of anything.
3. The urgency. The transfer is "processing now" and only immediate action stops it. The deadline is the emotional engine of the whole scam: frightened people do not verify.
4. The extraction. Now comes the ask, in one of a few predictable forms: read back the code we just texted you, approve this push notification, move your money to a "safe account", or install a remote-access app so the "analyst" can help.

The instant a "bank" asks for a one-time code, the call is a scam — full stop.

Why your bank never asks for codes or transfers

This is the single most important rule in phone banking, and it holds at every major New Zealand bank — ANZ, ASB, BNZ, Westpac, and Kiwibank alike: your bank will never ask you for a one-time passcode, never ask you to move money to keep it safe, never ask you to approve a login you did not start, and never ask you to install remote-access software. One-time codes exist specifically to prove that the person holding your phone is you. The moment you read one aloud, you have handed over the last factor of authentication.

The "safe account" trick deserves special attention. There is no such process anywhere in New Zealand banking where a customer must move their own money for protection. Any instruction to transfer funds — to yourself, to a holding account, anywhere — coming from an inbound call is theft in progress, however official the caller sounds.

The verification callback: your strongest move

If a caller claims to be from your bank, hang up and call the number on the back of your card. This verification callback defeats spoofing entirely. Scammers can make any number appear on your caller ID — including your bank's genuine customer-service line — but they cannot intercept a call you place yourself to the real number on your card or in your banking app.

Habits that reinforce this defence:

• Never trust the inbound number. Spoofing your bank's real line takes nothing but cheap software, so caller ID proves nothing.
• Never use a number the caller gives you. "Call this department back at..." is the same scam with extra steps.
• Say nothing about your accounts before hanging up. Even confirming "yes, that is my account" hands the scammer useful data.
• Tell the real fraud team. When you reach your actual bank, report the impersonation attempt — banks track these campaigns and may flag your profile.

Red flags specific to bank-call scams

Beyond the universal tells of urgency and secrecy, watch for these banking-specific signs:

• Code and approval requests: any code, PIN, password, or push approval requested on an inbound call.
• Remote-access apps: TeamViewer-style tools have no place in a bank fraud process; they exist so the scammer can operate your banking session directly.
• Stay-on-the-line pressure: scammers insist you keep talking while you "verify" things, because a paused call is a call where you might think or check.
• Follow-up texts that "prove" identity: a text arriving mid-call with a code or link proves nothing — the scammer triggered it by attempting a login or transfer in your name.

If you already gave up information or money

Speed matters more than embarrassment. Act immediately:

1. Call your bank's real number now. Ask them to freeze accounts and cards, attempt to reverse or recall transfers, and reissue anything compromised. For fast payments, minutes can decide whether funds are recoverable.
2. Change your passwords from another device, starting with online banking and email, and enable two-factor authentication everywhere it is offered.
3. Report the scam to Netsafe at netsafe.org.nz and, for financial loss, to NZ Police on 105.
4. Watch for recovery scams. Criminals often ring victims back days later posing as "recovery agents" who can retrieve the money for a fee. They cannot — it is the same gang running round two.

The fake bank call succeeds because it borrows the institution you trust most with your money. Keep one rule and it fails every time: hang up on unsolicited fraud alerts, call your bank back on the card's number, and treat any request for a code as the scam it is. No real bank will ever be upset that you verified — and the fake ones cannot survive being verified.