It can start with a phone call that seems completely legitimate.

Someone claiming to be from your bank says there’s suspicious activity on your account. They may already know your name, where you bank or other personal details. Then they ask you to “verify” some information or read back a security code that was just sent to your phone.

You may think you’re helping stop fraud. Instead, you could be giving a criminal what they need to take control of your account.

This is an account takeover scam and knowing how it works can help you stop it. 

What is an account takeover?
An account takeover happens when a criminal gains access to one of your financial or online accounts.

Once inside, they can change your password and contact information, lock you out of the account or transfer money elsewhere.

The scammer often doesn’t start from scratch. They may already have pieces of information about you from a compromised email account, data breach, phishing attempt or other source. What they still need is the final piece that lets them into your account.

That’s where the phone call, email or text comes in.

How the scam works
The criminal contacts you while pretending to represent a trusted financial institution. They create urgency by telling you something is wrong with your account. Then they ask for information.

For example, they may attempt to reset your online banking password. That generates a legitimate security code sent to your phone. The scammer then asks you to read the code to them, maybe claiming it’s needed to verify your identity or stop a fraudulent transaction. If you provide it, you’re helping a criminal reset your password or get past multifactor authentication.

Never give a one-time access or verification code to anyone who contacts you.

Stop, hang up and call
If someone contacts you claiming to represent your bank and asks for personal or account information, don’t let urgency rush you into acting.

Stop the conversation. Hang up. Then call your bank using a trusted number, like the one on your debit or credit card, a statement or their official website.

Do not call back the number that contacted you. Caller ID can be manipulated to make a fraudulent call appear legitimate.

Protect the accounts criminals may target first
Your financial accounts aren’t the only ones that matter. Your email account has a wealth of personal information and may be connected to password resets for other accounts.

Use strong, unique passwords for both email and financial accounts. Consider a password manager so you aren’t tempted to reuse passwords. Turn on multifactor authentication whenever it is available.

Also be cautious about links in unexpected emails and text messages, even when the message looks official.

When something doesn’t feel right, call someone you know
Scammers depend on urgency, fear and confusion. A trusted second opinion can interrupt that process.

If you receive an unexpected request involving your Pinnacle accounts, contact your Pinnacle financial advisor or local office directly. We would much rather help you check a suspicious request before money moves than hear from you after the fact.

And if you believe you’ve already shared information or money with a scammer, contact your financial advisor or the Client Service Center immediately so we can help you determine the appropriate next steps.