Protecting Your Business From Bank Impersonation Scams
Bank impersonation scams are a critical threat to businesses and can cause significant damage quickly, from financial losses to reputational harm. Business owners, executives, and employees must understand these schemes to help protect their organizations. Learn how these scams work, who they target, and what your organization can do to stay protected.
What are bank impersonation scams?
In bank impersonation scams, fraudsters pretending to be representatives of a financial institution manipulate employees into providing sensitive information or clicking on malicious links or attachments. Scammers use sophisticated tactics — combining social engineering with technical manipulation — to appear legitimate, and they target anyone with access to financial accounts, from accounts payable clerks to CFOs.
Common scam tactics
Phone call scams (Vishing): Fraudsters call employees claiming to be from a bank’s fraud department, often referencing recent transactions or suspicious activity and using caller ID spoofing to appear legitimate. They may request credentials to “verify” transactions, claim accounts need security updates, or convince employees to move funds to a “safe account” controlled by fraudsters.
Text message scams (Smishing): Fraudsters send text messages to employees about locked accounts, unauthorized transactions, or expired cards, with links to fake banking websites designed to capture credentials.
Email scams (Phishing): Fraudsters send sophisticated emails with official bank logos to employees to request security updates, warn of unauthorized access, or claim failed transactions — all with links to malicious websites.
Advanced tactics: Other schemes include CEO/executive impersonation, vendor payment fraud, in-person impersonation, and remote access requests for “technical support.”
Red flags
Watch for these warning signs:
- Unexpected communications about account problems or transactions you didn’t initiate
- Unusual urgency or pressure to bypass standard procedures
- Requests for sensitive information, such as Social Security numbers, EINs, usernames, passwords, PINs, or one-time passcodes
- Instructions to move money to a “safe account” or purchase gift cards
- Remote access requests for computers or other devices
- Poor grammar, misspellings, or suspicious URLs that don’t match key.com
How to protect your business
Do not respond: If you receive a suspicious call, email, or text message claiming to be from KeyBank, hang up, do not respond, and do not open links or attachments.
Verify the source: Verify the legitimacy of a suspicious message by calling the number on the back of your business debit card. Never use contact details provided in a suspicious message.
Never share sensitive information: Key will never ask for your full Social Security number, EIN, username, password, PIN, or one-time passcodes through unsolicited calls, emails, or texts.
Refuse remote access: Key will never ask for remote access to your computers, phones, or other devices.
Enable account alerts: Set up notifications for Key account activity, including transactions above specified amounts, wire transfers, and ACH payments.
Use multi-factor authentication (MFA): Add an extra security layer to your accounts by requiring additional verification when signing on.
How to verify if a message is from Key
To verify if an email or call is from Key:
- Call 1-888-KEY4BIZ® (1-888-539-4249). Dial 711 for TTY/TRS.
- Call the phone number on the back of a Key debit or credit card.
- Visit a local branch.
To verify if a text message is from Key:
- Visit key.com/shortcodes to confirm that the sender’s number matches one of our five- and six-digit codes.
If you did not initiate an interaction with Key, we will never contact you unexpectedly by phone, text, or email to ask for your full Social Security number, login ID, or other personal information.
NOTE: If your business recently applied for a Key product, we may need to contact you for personal information related to your application.
What to do if you suspect fraud
If you suspect fraud, immediately call the KeyBank Fraud Client Service Center at 1-800-433-0124. Dial 711 for TTY/TRS.
Stay informed
Bank impersonation scams continue to evolve as criminals develop new tactics. Help protect your business by staying up to date on the latest fraud trends, educating your employees, and creating a culture where employees feel comfortable reporting suspicious activity — early detection can minimize damage and protect your organization. For trusted fraud prevention resources, including articles, webinars, and flyers, visit Key’s Business Security Center at key.com/businessfraud.