Call-Back Rule
Never trust the number that called you. Verify by calling the official line yourself.
When your "bank", a "government office", or "tech support" calls with an urgent problem, the safest assumption is that the call is fake — and the fix is the same every time: hang up and call back on a number you find yourself. A real institution is happy to be called back. A scammer needs you to stay on the line.
The number that called you proves nothing
Caller ID can be faked. Scammers routinely "spoof" a real bank or agency name and number so your screen shows exactly what you'd expect — which means the incoming call carries zero proof of who's actually on it. The FBI's standing advice is to "verify the identity of the person calling you by hanging up the phone, researching the contact of the bank or organization... and call the phone number directly."
So the question is never "does this call look real?" — it's "have I reached this organization through a number I trust?" Until you have, you haven't verified anything, no matter what the screen says.
What the Call-Back Rule is
It's one move: end the call, then reach the organization yourself on an independent, known number. You don't argue, you don't "just confirm one detail", and you never use a number, link, or extension the caller gave you. You hang up and start a fresh call you control.
If the problem is real, the official line will know about it. If it's a scam, calling the real number is how you find that out safely — and you've spent nothing but two minutes.
Where to find the real number
Use a number you can independently trust: the one printed on the back of your bank card, on a paper statement, on the official app, or on the organization's real website that you typed in yourself. For a government agency, look it up on its official site rather than dialing anything from the message.
Don't call back the number that just rang you, and don't trust a number the caller reads out — both can belong to the scammer. The whole point is to route around the channel the scam arrived on.
Why they fight the hang-up
Scammers will say staying on the line is faster, that hanging up will "cancel the security hold", or that you mustn't tell anyone. That resistance is the tell. The IC3 is blunt that "the US Government and Law Enforcement will never request you send money via wire transfer to foreign accounts, cryptocurrency... gift/prepaid cards" — and no legitimate caller is harmed by you confirming through an official line.
The harder someone pushes you to stay on this call, the more sure you can be that this call is exactly where the danger is.
- Treat any unexpected call about your money or accounts as unverified — no matter what the caller ID shows.
- Don’t confirm codes, move money, or grant access while still on the call. Just end it.
- Find an independent number: the back of your card, a statement, the official app, or a site you typed in yourself.
- Call that number and ask whether the issue is real. Never use a number, link, or extension the caller gave you.
- If you’re unsure whether a call dropped legitimately, wait a moment and dial out yourself — scammers sometimes stay on the line to fake a “new” call.
What it looks like with a "fraud department" call:
Sources
Frequently asked
The caller ID showed my bank’s real name and number. Doesn’t that confirm it?
No. Caller ID is easily spoofed to display a genuine name and number, so it confirms nothing about who is actually calling. That's exactly why the rule is to ignore the incoming call's details and reach the organization through a number you find independently.
They said hanging up would cancel a security hold or make things worse. Is that true?
No — that's pressure designed to keep you on the line. A real bank or agency will never be harmed by you calling back on an official number, and no genuine security process collapses because you took two minutes to verify. The urgency to stay on the call is itself a warning sign.
What if I call back and there really was a problem?
Then you'll be connected to the real team on a number you trust, and you can sort it out safely — you lose nothing by calling back. The Call-Back Rule never causes you to miss a genuine issue; it just makes sure you handle it through a channel a scammer can't control.