How Scammers Empty Your Bank Account

The Attacks You Need to Recognise

It starts with a call that sounds routine. "Good afternoon, this is the fraud department at your bank. We've noticed a suspicious transaction on your account." The caller knows your name. They sound professional. They just need you to confirm a code so they can "block" the transaction.

Ten minutes later, your account is empty.

Scammers use many different tactics to steal money and take over accounts. These attacks may look different, but they often follow the same pattern:

1. Create urgency: "Act now or your account will be closed."
2. Impersonate someone you trust. This could be your bank, mobile provider, employer, or a family member.
3. Persuade you to take an unsafe action such as revealing personal information, approving a transaction, sending money, or installing an app.

For people in Jamaica and elsewhere, understanding these methods is important because criminals do not always need sophisticated hacking tools. Often, they simply persuade someone to open the door.

1. Prize scams: "You have won, but you must pay first"

A prize scammer may contact you by phone, WhatsApp, text, email, or social media. They may claim to represent a company, promotion, radio station, lottery, government agency, or international organisation.

The story sounds convincing until they ask you to pay before receiving the prize.

They may request:

• A processing fee
• Taxes or customs charges
• Shipping or delivery costs
• A refundable deposit
• Gift cards
• A bank transfer
• Mobile-wallet payment
• Cryptocurrency
• Your bank details or identification

The scammer may start with a small amount and then invent another charge. Once you pay, the "prize" never arrives.

Remember this rule:

A legitimate prize does not require you to pay money to receive it.

What to do

Do not reply, send identification, click links, or provide your banking information. Search for the promotion independently and contact the company through its official website or verified number. Do not use contact details supplied by the person who contacted you.

If you already paid, contact your bank, card issuer, payment app, or money-transfer service immediately. Ask whether the transaction can be stopped or reversed.

2. Vishing: the fake phone call

Vishing is phishing over the phone.

The caller may claim to be from your bank, the police, your mobile provider, a technology company, or a government agency. They may know your name or part of your personal information, which can make the call sound legitimate.

They may ask you to:

• Read out a verification code
• Move money to a "safe" account
• Confirm your password or card details
• Install an app
• Share your screen
• Approve a login notification

This is how the money disappears: the victim gives the scammer the information or approval needed to enter the account or authorise a transfer.

What to do

End the call. Contact the organisation using the official number on your bank card, statement, app, or website.

Never share a password, PIN, or one-time code with someone who contacted you unexpectedly. A legitimate bank will not ask you to move your money to protect it.

3. AI voice cloning: the fake family emergency

Scammers can now copy someone's voice using just a few seconds of audio from a voice note, video, or social media post. They then call pretending to be your child, parent, or partner, claiming they've been arrested, had an accident, or are stranded and need money right away. The voice sounds real, the panic sounds real, and they'll often beg you not to tell anyone.

What to do

Hang up and call the person directly on the number you already have. Agree on a family code word that only your household knows, and ask for it on any emergency call about money. A real family member will understand. A scammer won't know it.

4. Malicious apps and fake downloads

Some criminals persuade people to install an app that looks useful. It may be presented as a security tool, video player, loan app, a game, or even aproductivity tool.

Once installed, the app may display fake login screens, read notifications, monitor activity and capture verification codes.

What to do

Only install apps from the official App Store or Google Play Store, and keep your phone updated. Be especially cautious if someone tells you to install an app during an unexpected call or message.

Review apps that have access to notifications, accessibility settings, device administration, VPNs, or permission to install other apps. These permissions can give an app far more control than ordinary access to photos or contacts.

If you installed something suspicious, stop using the device for banking. Remove the app, update the device, change exposed passwords from a trusted device, and contact your bank if financial information may have been accessed.

5. Drive-by website attacks

A drive-by attack occurs when a malicious or compromised website tries to exploit a browser or device weakness, or tricks you into taking an unsafe action.

The page may display a fake virus warning, redirect you to another site, ask you to download an "update," request permission, or present a fake login page.

Phones can be affected, but simply visiting a suspicious website does not usually mean your bank account has been emptied. The risk becomes more serious if you downloaded or installed something, granted permissions, entered a password, or approved a security prompt.

What to do

If you clicked a suspicious link, close the page, remove anything you installed because of it, update your phone and browser, and monitor your accounts.

If you entered banking information, change your credentials from a trusted device and contact your bank.

6. SIM swapping: stealing your phone number

A SIM swap happens when a criminal convinces your mobile provider to move your phone number to a SIM card or eSIM they control.

This can happen whether you use a traditional physical SIM or an eSIM. The attacker does not need to steal your actual phone. They are trying to take over your number.

Once they control it, they may receive your calls and text messages, including one-time banking and email verification codes. They can then try to reset your accounts or transfer money.

Warning signs

• Your phone suddenly shows "No Service"
• You cannot make calls or receive texts
• Your SIM stops working without explanation
• You receive a notification about a SIM change you did not request

What to do

Call your mobile provider immediately from another phone. Ask them to restore your number, secure your account, reset your customer PIN, and block number transfers if that option is available.

Then contact your bank and email provider. Use an authenticator app or security key instead of SMS verification whenever possible.

7. Phishing: fake emails that steal your login

Phishing emails pretend to come from a bank, employer, delivery company, streaming service, or online platform.

They often claim that:

• Your account will be closed
• A payment failed
• A suspicious login was detected
• You need to verify your identity
• You are owed a refund
• You must review an invoice

The link leads to a fake website. When you enter your username, password, card details, or one-time code, the attacker receives them.

What to do

Open the company's official app or type its website address yourself. Do not use links in unexpected emails.

Check the sender's full address, but do not rely on that alone because email addresses can be spoofed.

If you entered your information, change the password immediately from a different trusted device and contact the affected company.

8. Smishing: phishing through text and WhatsApp

Smishing is phishing sent through SMS, WhatsApp, Messenger, or social media.

The message may claim to be from your bank, mobile provider, delivery company, or a friend. It may contain a link, an urgent request, or a number to call.

The attacker may be trying to steal your login details, install malware, or persuade you to send money.

What to do

Do not click, reply, or call the number provided. Contact the organisation through its official website, app, or phone number.

If a message appears to come from someone you know and asks for money, call them directly. Accounts can be hijacked, and message threads can be manipulated.

The WhatsApp code scam

One of the most common tricks is a message from a friend's number saying: "Hey, I sent you a code by mistake, can you send it back?"

That code is actually a WhatsApp login code for your number. Once you share it, the scammer takes over your account and starts messaging your contacts, asking for money in your name.

Turn on two-step verification in WhatsApp (Settings > Account > Two-step verification). This adds a PIN that a scammer would also need to take over your account. Never share a code sent to your phone, no matter who asks.

9. Fake technical-support scams

Someone may contact you claiming that your phone, computer, email, or bank account has been hacked. They then ask you to download remote-access software so they can "fix" it.

Once connected, they may watch you log in, access files, steal passwords, change settings, or direct you to your bank account. Some will tell you to send money to secure it.

What to do

Never give remote access to an unknown person. Do not download software because of a pop-up or unsolicited call.

If you already granted access, disconnect the device from the internet, contact your bank from another device, remove the remote-access software, change your passwords, and have the device checked.

10. Password reuse and account takeover

Credential stuffing happens when criminals use passwords stolen from one website to try logging into other services.

If you reuse one password for email, banking, shopping, and social media, one breach can put all of them at risk.

What to do

Use a different password for every important account. A password manager can create and store strong passwords for you.

Turn on multi-factor authentication, especially for email, banking, payment apps, and cloud storage.

Protect your email particularly well because it can often be used to reset everything else.

Already been hit? Do this now.

If money has already been taken, do not wait until you understand exactly what happened.

1. Contact your bank or card issuer using an official number. Ask them to freeze affected cards, stop pending transactions, secure online banking, remove unfamiliar payees, and investigate the activity.
2. Contact the payment app, wallet, exchange, marketplace, or transfer service involved. Ask whether the payment can be frozen, cancelled, recalled, or disputed.
3. Secure your email and other accounts from a trusted device. Change reused passwords, sign out other sessions, remove unfamiliar devices, and check recovery details and email-forwarding rules.
4. Contact your mobile provider if you suspect a SIM swap.
5. Save screenshots, messages, phone numbers, transaction IDs, amounts, dates, and case numbers before deleting anything.
6. Be careful of "recovery" scammers. Anyone who promises to recover your money for an upfront fee may be targeting you again.
7. Report the fraud to the police. A police report may be required by your bank for a dispute and helps authorities track scam patterns.

The golden rules

Slow down. Verify through an official channel. Never share passwords, PINs or one-time codes.

Keep your devices updated, and treat unexpected urgency as a warning sign.

Most scams succeed because someone is rushed into a decision before they have time to think. The more you understand how these tactics work, the easier they are to spot. A little knowledge and a moment of caution can go a long way toward protecting yourself.

If this helped, share it with someone who might need it, especially older relatives. They are often the first target.