The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If someone claiming to be your bank asks for a verification code, your password, remote access to your device, or a transfer to a “safe” account, stop communicating. Contact your bank through its official app or website, or call the number on your card or a recent statement. If you already shared account access or sent money, contact the bank’s fraud team immediately and ask it to secure your accounts and attempt to stop or reverse the transaction.
First, stop the contact and verify your bank independently
- End the call or conversation. Do not reply, click a link, open an attachment, install an app, or call a number supplied by the suspicious contact.
- Reach the bank through a channel you choose. Use the bank’s official app or type its known website address yourself, or call the phone number printed on your bank card or a recent statement. Avoid search advertisements when looking for a number: the Federal Trade Commission warns that fake bank phone numbers can appear in paid search listings. FTC guidance on unexpected calls.
- Ask the bank to confirm whether there is a real alert. Describe the contact and ask whether any account activity needs attention. Do not use the contact’s caller ID, message, link, or official-looking materials to verify who they are.
A familiar voice, convincing video, bank logo, or caller ID is not proof of identity. The Consumer Financial Protection Bureau (CFPB) says AI can make voice cloning and realistic images or video easier, while caller ID and messages can also be faked. The available official guidance does not provide a dependable way to identify AI-generated audio or video. Treat unexpected contact as unverified and reach the bank independently. CFPB guidance on scams and fraud.
Recognize the requests that should end the conversation
- A one-time passcode or verification code: Do not read it aloud, send it in a text, or enter it into a site reached from the message. The FTC says, “No caller — especially someone from your bank or investment company’s fraud department — will ever ask for the verification code.” FTC consumer alert, June 2024.
- A transfer to protect your money: Do not move funds to a supposedly safe account, even if the caller says your account is under attack. The FTC identifies this request as a scam indicator, not a legitimate bank procedure.
- Credentials or device access: Do not disclose your password or other login details, approve an unexpected sign-in, or let the caller control your phone or computer. The FBI describes impostors seeking credentials and multi-factor authentication codes to take over accounts. FBI Internet Crime Complaint Center account-takeover alert.
- Secrecy or pressure: A caller telling you not to talk to anyone is another warning sign. The FTC says, “No legitimate fraud department will tell you to keep the call a secret.” FTC guidance, January 2026.
If you shared a code, password, or account access
- Call the bank’s fraud team now using the official app, website, card, or statement—not the suspicious contact. Say exactly what you shared and when, and ask the bank to secure the affected account, review recent activity, and check whether linked accounts or payment methods also need protection.
- Change exposed credentials. Reset the compromised password and any other exposed login information. If you reused that password elsewhere, change it on those services too. Use a unique password for each account.
- Review account activity and access. Ask the bank to check for unfamiliar transactions, profile changes, new payment recipients, or other signs of account takeover. Follow its instructions for restoring secure access.
- Preserve the evidence. Keep the messages, sender addresses, phone numbers, websites, transaction details, and names of any apps or software the caller asked you to install. These details can help the bank and investigators.
The FBI advises victims of account takeover to contact their financial institution promptly, reset compromised and reused credentials, and submit a detailed complaint to the FBI’s Internet Crime Complaint Center (IC3). Its alert asks for details such as the impersonated institution, contact information used, websites or software involved, and financial accounts the scammer supplied or used. FBI account-takeover guidance.
If you sent money or see an unauthorized transaction
- Contact the bank immediately. Tell its fraud team how the payment was made, when it happened, the amount, and the recipient details. Ask it to attempt a recall or reversal and to secure any affected accounts. A recall or reversal is a request, not a guarantee that the money can be recovered.
- For a fraudulent wire, notify both the bank and IC3 promptly. The FBI specifically advises reporting fraudulent wires to the financial institution and IC3 immediately.
- Ask how the bank is classifying the payment. A transaction made by someone else without your authorization may be treated differently from a transfer you personally initiated after being deceived. Explain the circumstances fully and ask what rules and deadlines apply to this payment type.
- Keep a record of your report. Note when you contacted the bank, whom you spoke with, any case number, and the bank’s instructions. Save relevant statements and communications.
For unauthorized electronic fund transfers, the CFPB’s general guidance says a bank or credit union generally has ten business days after notice to investigate. If it determines an error occurred, it must correct it within one business day and then report its findings within three business days. Those timelines are not a promise that every scam-related loss will be reimbursed: liability and notification rules vary with the transaction and circumstances, including some debit-card, PIN, and other electronic-transfer cases. Ask the bank for advice specific to your payment and consult the CFPB’s guidance on unauthorized transactions.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Report the impersonation
- Tell the bank through a trusted channel. Report the impersonation even if you did not lose money so the bank can investigate and potentially warn others.
- File an IC3 complaint at ic3.gov for suspected cyber-enabled account takeover or a fraudulent wire. Include the contact details, websites or software involved, transaction information, and relevant financial accounts.
- Report the scam to the FTC at ReportFraud.ftc.gov.
- Consider your state attorney general or local police. The CFPB lists these as additional reporting options.
Impersonation scams cause substantial reported losses, but the figures are broader than AI or bank impersonation. The FTC reported nearly $3 billion in losses to impersonators in 2024; that covers impersonators generally, not only bank scams or AI-enabled scams. Separately, the FBI said IC3 had received more than 5,100 account-takeover complaints involving losses exceeding $262 million since January 2025, in its November 25, 2025 alert. Those are reports to IC3, not a count of every incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.After the immediate risk is contained
Once the bank has secured the account, review its official security guidance. The FBI recommends unique, complex passwords and multi-factor authentication where available. Turn on available account alerts and review contact details and recovery options so you can spot changes you did not make. If you consider a physical security key or another sign-in method, first check the bank’s own documentation for compatibility; support varies by institution.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
