Fake bank adviser

What you need to understand

• For the caller pretending to represent a bank, first check the requested action, the channel used and what may already have happened if you clicked, paid or shared a code.
• Use an official channel for the caller pretending to represent a bank that you open yourself. A received link, QR code or phone number is not a reliable starting point.

The scenario, step by step

• The caller introduces themselves as the fraud department and describes a worrying transaction. The number shown may seem to be the bank's number, but that does not prove where the call comes from.
• They keep the victim on the line, talk them through the steps and turn each confirmation into an alleged cancellation or security measure.
• The pressure stops you from calling back independently. The call may be preceded by phishing that already gave the name, bank or some of the customer's data.

What the fraudster is trying to get

• Reader codes, SMS codes and itsme confirmations.
• A transfer to a supposed secure account or the installation of remote access.

Common variants

• A call after a fake bank SMS.
• A fake Card Stop employee or fake police officer.
• A request to install AnyDesk or hand over the card to a courier.

Warning signs in your case

• Incoming call
• Urgency
• Request for secrecy or confirmation

What a legitimate service would do

• A adviser accepts that you hang up and call back on the official number.
• They do not ask for a PIN, a transfer to a secure account, or control of your device.

Belgian context and fraud chain

• The fake adviser uses banking language and may have data from earlier phishing. Knowing your name, your bank or a recent transaction gives them no authority.
• The call is a way to take control: the other person keeps the line open, comments on the screens and prevents the victim from getting a second opinion or calling the bank back.

Decision points to check

• Hang up without saying which number you are going to call. Then look up the number yourself in the app, on the card or on the official website you typed in manually.
• Treat every code or confirmation button shown as a real transaction. The words cancel, secure or test said on the phone do not change the technical effect of the confirmation.
• Refuse any remote control tool and any handover of the card. These requests are not needed to check a bank alert.

How to check safely

• Do not reply to the message and do not use the link, QR code or number it contains.
• Open the official app or website yourself, then check whether the same request appears in your personal account.
• If in doubt, contact the organisation using a number found on its official website, a reliable bill or your bank card.

What to do immediately

• Hang up and call the bank back using the official number.
• Do not give any code.

If you have already clicked, paid or replied

• Stop the exchange and do not try to negotiate with the sender.
• Change the access details through the official service. Contact the bank immediately if a payment, card, IBAN or confirmation is involved.
• Keep the exchanges, payment references and observed addresses for the report, without publicly sharing personal data.

What to do after an incident

• After the call, note the number shown, the time, the name used and the actions requested, but do not call that number back for explanations.
• Contact the bank immediately and say whether the caller saw your screen, received a code, obtained a transfer or had software installed. Each element leads to a different response.
• If the device was controlled remotely, disconnect it from the network and have the access and software checked before resuming sensitive transactions.

Limits and level of proof

• Number spoofing is possible, but it cannot be confirmed from a screenshot of the call alone.
• This page describes observable tactics; it does not let you identify the caller or confirm the source of a data leak.

Analysis grid for the caller pretending to represent a bank

• To review a the caller pretending to represent a bank case, separate four questions: who makes contact, through which channel, what action is requested, and which independent element can confirm it. One reassuring answer does not make up for the other inconsistencies.
• The priority signs in this case are: incoming call, urgency, request for secrecy or confirmation. Their combination matters more than the isolated presence of a word, a logo or a typo.
• Always compare the message with the real status of the service. For a the caller pretending to represent a bank, a request that does not appear in the app, on the account or in the official contact should remain undone until it is confirmed.

When to ask for immediate help

• In a the caller pretending to represent a bank case, contact the relevant service without delay if a code, confirmation, payment, card, identity document or remote access has already been shared. Describe the exact action rather than saying only that you were hacked.
• If no sensitive action was taken, keep the useful evidence, block the contact and use the detector to document the signs. This difference avoids confusing prevention, a confirmed incident and a simple unsolicited message.

What to do now

• If you have not acted, do not click further and open the named service's official channel yourself.
• If you clicked, close the page, enter nothing else and note what information was shown or requested.
• If you shared a code, card, password or payment, contact your bank or the relevant official service immediately.
• Keep the message, time, link used and any useful screenshots. Share them only with an official reporting channel or a trusted helper.

Limits of this page

• This page does not prove that a message is safe and does not replace your bank, the police, Safeonweb, a platform or a public service.
• A scam may be new, very well written or described with too little context. Use the result as decision support, not as absolute certainty.
• Before taking a final action, checking through the official channel matters more than the appearance of the received message.

Check through an official channel

• Type the service address yourself or open the official app. Do not use a phone number, link or QR code from the suspicious message to verify the situation.
• When money, card details, a code or account access are involved, the safety action comes first. The analysis can then help organise the evidence.

How to read the result

• A low number of signals does not mean that everything is safe. It only means that this page or analysis did not find decisive evidence with the information available.
• Focus on the requested action: paying, sharing a code, installing an app, approving a bank action or leaving an official platform. That action matters more than a logo, sender name or polished wording.
• If the situation feels urgent, step away from the received message first. Then check calmly through a channel you already trusted before the message arrived.

Belgian reading of this situation

• For the caller pretending to represent a bank, focus on the relevant Belgian next step: open the official channel yourself, contact the bank, use Safeonweb or preserve evidence.
• The right decision for the caller pretending to represent a bank depends on what has already happened. Reading a message is not the same as clicking, paying, sharing a code or granting remote access.

Frequently asked questions

Useful official sources

• SPF Économie - Allô ? Escrocs au bout du fil - link checked on 2026-09-17
• Febelfin - Fraude au faux support technique bancaire - link checked on 2026-09-17
• SPF Économie - Arnaques téléphoniques - link checked on 2026-09-17
• Safeonweb - Soyez vigilant face aux appels et SMS suspects - link checked on 2026-09-17
• SPF Économie - Victime d'une arnaque ? Que faire ? - link checked on 2026-09-17