Spoofing Now Fakes Your Real Bank's Phone Number: What to Know Before You Answer That Call

Your phone rings and the screen shows the exact number of your bank, the same one saved in your contacts. You answer with confidence, and if something feels off you even hang up and call that number back to double-check. But the callback is answered by a recording identical to your bank's own, and you end up sharing a one-time passcode you should never have given out. That is the trap of "spoofing," or phone number impersonation, and experts gathered this week by Puerto Rico's Society of Certified Public Accountants (CCPA) warn it is the fastest-growing fraud method against individuals, businesses, and government agencies on the island ¹.

Context

During the conference "Fraud or Cybersecurity Risk Investigations in Private Business and Government," organized by the CCPA, several specialists agreed that fraud schemes have become nearly indistinguishable from legitimate communications ¹. Eduardo Gonzalez Green, a certified public accountant (CPA) and certified fraud examiner (CFE), explained that many companies entrust their cybersecurity entirely to in-house IT staff without dedicated specialists, leaving enormous gaps in vulnerability ¹. Melvin Rosario Crespo, an associate professor of Criminal Justice at Inter American University, went further, saying the discussion around prevention is limited both in Puerto Rico and globally, because organizations prefer to talk about how a fraud was detected after the fact rather than what failed beforehand to let it happen ¹. Penelope Freytes, fraud monitoring supervisor at Banco Popular, detailed exactly how spoofing works against bank customers: scammers disguise a phone number, sender name, or website address so the victim believes they are dealing with a trusted source, citing the FBI's own definition of the practice ¹. The most dangerous part, she said, is that even when a customer hangs up and calls back the number shown on screen, they can reach a fake recording identical to their real bank's, reinforcing a false sense of security ¹.

The numbers

The figures behind this warning are stark. In 2025, the Federal Trade Commission (FTC) received more than one million complaints about impersonation scams in the United States, and reported losses rose nearly 20% to reach $3.5 billion ². According to the agency's own data, nearly one in three fraud reports filed in 2025 involved this kind of impersonation scam, making it the single most-reported fraud category of the year ²³. At the corporate level, a Forrester Consulting study commissioned by TransUnion found that 63% of executives surveyed named phone spoofing among the top five challenges in their outbound communications, yet only 30% of those same companies have technology in place to protect against it ¹. And in Puerto Rico's public sector, the picture is no better: according to Special Report OIG-IE-26-005 from the Office of the Inspector General, cited at the conference by Inspector Ivelisse Torres Rivera, 42 of 90 government entities that responded to a questionnaire admitted they have no cybersecurity risk analysis in place, despite current technology-governance regulations requiring one ¹. Of those 90 entities, 85 reported having backups and 72 a recovery plan, but only 33, or 37%, had actually tested that plan ¹.

What it means for you

The correct number on your phone screen is no longer proof of anything. A scammer can digitally clone the caller ID of your bank, a government agency, or a service provider, and may even have a fake recording set up waiting for your verification call. If anyone asks for a one-time passcode (OTP), a full account number, or personal data confirmation over the phone, that is a red flag no matter how legitimate the call looks. The same applies if you run a small or medium business in Puerto Rico: leaving cybersecurity entirely in the hands of internal IT staff, without an independent outside review, is exactly the pattern fraud examiners flag as most common right before an incident happens ¹.

How to act / Checklist

1. Never confirm or share a one-time passcode (OTP), full account number, or password over the phone, no matter who claims to be calling.
2. If you get a call supposedly from your bank, hang up and dial your bank using the number printed on the back of your card, not the one that appeared on screen or one given to you over the phone.
3. Turn on real-time transaction alerts in your bank's app to catch unauthorized activity instantly.
4. Use app-based multi-factor authentication (not text message codes) for your banking and email accounts.
5. If you own a business, hire an outside cybersecurity review at least once a year instead of relying solely on internal IT staff.
6. Make sure your data recovery plan, personal or business, is actually tested at least once a year, not just on paper.
7. Report any spoofing or impersonation attempt to the FTC (reportfraud.ftc.gov) and the Federal Communications Commission (FCC) in addition to your financial institution ²⁴.
8. If a call pressures you with urgency, threats, or unusual payment methods like cryptocurrency or gift cards, hang up: those are classic fraud warning signs according to the FTC ³.

What's next

The Office of the Inspector General has already recommended that the 90 entities evaluated complete their pending risk assessments and, above all, actually test the recovery plans they claim to have on paper, something only 37% of them currently do ¹. The CCPA said it will keep offering fraud and cyber-risk training to both private companies and government agencies, while banks like Popular reinforce their fraud-monitoring units as spoofing calls rise ¹. At the federal level, the FTC continues publishing its annual fraud reports, and the next update to the Consumer Sentinel Network Data Book is expected to show whether losses from impersonation scams keep climbing into 2026 ². In the meantime, the experts' advice is simple: treat any unsolicited call, no matter what number it shows, with the same suspicion you would give a stranger asking for the keys to your account.