The call sounds real. The caller knows your name, your bank, even your recent transactions. There's a problem with your account, and they've called to help you sort it out.

By the time the call ends, you've moved the money yourself. To an account that belongs to the scammer.

What is social engineering?

Social engineering is psychological manipulation: a scammer plays a trusted role to make you hand over access, money, or information yourself.

Social engineering works by getting inside your head before the scammer gets into your account. The attacker plays a role: a fraud investigator, a bank security agent, customer service from your phone company. That's all they need to start asking questions. In banking, these attacks mainly run through phone calls, texts, or both. Sometimes all three, weeks apart.

AI is making these attacks harder to spot. A short audio clip is now enough to clone someone's voice: a voicemail, a few seconds from a public video. Real-time deepfakes can put a face on a video call as it happens. Things like your name, your bank, and a recent transaction get assembled automatically from public profiles and leaked databases. The scammer doesn't need to know you personally.

How an attack unfolds

It opens with urgency. "Your account is under attack." "There's been suspicious activity and we need to secure your funds right now." Scammers need you to be worried before you have a chance to think. A panicked person acts first and asks questions later.

Then authority. The caller claims to be from your bank's fraud team, a specialist assigned to your case. There's a reference number, a job title, sometimes a real employee name you could check on LinkedIn. Some callers even transfer you between departments. It's meant to feel like a real organization dealing with a real problem.

By the time they ask you to transfer funds or download something, you've been on the call for fifteen minutes. You've confirmed your details. You've heard a plausible story about what went wrong. You've followed steps that looked exactly like a real fraud investigation. By then, you just say yes.

Not every attack starts with a phone call. Some begin weeks earlier with a phishing email or a suspicious text. You click a link, fill in a form, and the scammer now has your name, your bank, and enough to sound credible when they call later. By the time the phone rings, it feels like they know you, because they already got what they needed.

Some attacks layer all of this: a text first, then an email, then a call, sometimes days or weeks apart. Each contact makes the next one feel more legitimate. Phishing is often where the chain starts. Catching it early can stop things before they ever reach a call. Calls that specifically impersonate your bank are covered in more depth in fake bank calls and vishing.

Why it even works on careful people

A technician in a uniform gets let into the building. A doctor who introduces themselves gets followed into the treatment room. That's not naivety. It's just how trust works. Over the phone, a job title and a reference number are enough to seem legitimate.

Under time pressure, you think faster and question less. After fifteen minutes of cooperating and being passed between departments, stopping starts to feel like you're the one causing the problem.

These attacks are designed to work on careful people. If you've been through one, it's not on you.

How bunq protects you

The most reliable rule: never act on a phone call without checking the in-app chat first.

bunq never calls. Any call claiming to be from bunq is a scam. Open the app: a real alert will be there if something needs your attention.

Scammers rely on urgency. Safety Shield is designed to counter that. When a payment looks unusual, it's paused for 24 hours before it goes through. The hold can't be bypassed by you or by bunq. That's intentional. If the transfer was legitimate, it goes through once the 24 hours are up. If it wasn't, you have time to catch it.

Scammers often ask you to install remote access software, such as AnyDesk or TeamViewer. Their story: the "fraud team" needs to take a look remotely. Once that software is running, the attacker can see and control everything on your screen, including your banking app. bunq detects when any screen-sharing app is active and limits outgoing payments automatically.

Being your bank means bunq sees everything a scammer never will: your full account history, your patterns, in real time. If we see something unusual, we act before you even have to ask.

Read more about how bunq keeps your money safe, including deposit protection and fraud detection. For steps you can set up yourself, safe online banking covers the practical side.

If you think you're being targeted right now

Put the phone down.

Close any remote access software you've installed (AnyDesk, TeamViewer, or similar). Reset your security code in the app to lock the fraudster out of your account. Then contact bunq SOS support, reachable in under 20 seconds inside the app, and report the fraud via the Anti-Fraud Guide.

bunq's SOS line is reachable in under 20 seconds inside the app. The Anti-Fraud Guide walks through every step.

If a transfer has already gone through, report it. bunq reviews fraud cases for a goodwill refund.

Final thoughts

Social engineering works best on people who don't know what it is. Now you do.

Whether it comes as a text, an email, or a call, urgency is a red flag, not a reason to act. Open the app first. If something's really wrong, it'll be there.