FBI alerts iPhone and Android users to rising bank account takeover fraud that has caused people lose $262 million

scam

Scammers and fraudsters keep finding new techniques to trap their targets and this time around, they’ve found a way to take over your bank accounts that can lead to major financial losses. Citing the increasing number of such cases globally, The Federal Bureau of Investigation (FBI) has issued a critical public alert warning iPhone and Android users about it.

The agency said cybercriminals are increasingly impersonating financial institutions through calls, texts, emails, and fraudulent websites to gain access to victims’ online banking, payroll, and health savings accounts. According to the Internet Crime Complaint Center (IC3), more than 5,100 ATO-related complaints have been filed since January 2025, resulting in losses exceeding $262 million (approximately Rs 2,341 crore.

How the fraud works: Let’s understand it step-by-step

According to the FBI’s advisory, scammers have refined their tactics to appear more convincing than ever. They often impersonate bank employees, customer support agents, or technical support staff to trick victims into sharing sensitive details, including login credentials and one-time passwords (OTPs) used for verification.

Once the victim hands over these details, criminals can reset account passwords and lock users out of their own accounts.

Fraudsters initiate contact through phishing texts, emails, or calls claiming there are suspicious or fraudulent transactions on the user’s bank account. In some cases, criminals escalate the manipulation by involving a second scammer posing as law enforcement, convincing victims to share more personal information under the guise of preventing further fraud.

Another rising tactic is the creation of fake bank websites, built to closely resemble legitimate online banking portals. These phishing sites capture users' login information the moment they attempt to sign in.

Some cybercriminals are also leveraging Search Engine Optimization (SEO) poisoning by purchasing fraudulent ads that appear at the top of search results, tricking users into clicking malicious links.

This is an AI generated infographic

What happens after criminals gain access

Once scammers gain control of an account, they quickly initiate wire transfers to accounts controlled by criminal networks. Many of these transfers are routed through cryptocurrency wallets, making the trail of stolen funds difficult to track. Victims often find themselves locked out of their accounts as criminals change passwords and take complete control.

How to protect yourself

The FBI urges iPhone and Android users to stay alert and take proactive steps to secure their online accounts.

Avoid sharing personal information online, especially details like birthdays, pet names, or school names that can help scammers guess passwords or security answers.

Use strong, unique passwords for every account.

Enable multi-factor authentication (MFA) wherever possible.

Do not click on search engine results or ads when trying to access financial websites.

Always use bookmarked links or manually type the official URL to open banking pages.

Treat suspicious calls claiming to be from your bank with caution — hang up and call the official bank customer service number yourself.

If you face an account takeover (ATO) incident, immediately contact your bank to request a recall or reversal of fraudulent transactions.

Report the incident to IC3 with complete details such as impersonated bank names, scammer contact numbers, fake website links, and affected financial account information.

Stay informed and cautious, as online fraud continues to evolve and become more sophisticated.