WASHINGTON, D.C. — The Consumer Financial Protection Bureau (CFPB) is sounding the alarm on a nationwide surge in text-message scams and bank account takeover attempts, many of which exploit stolen personal data and advanced social engineering techniques.
According to the CFPB’s latest consumer advisory, criminals are increasingly using smishing attacks, MFA bypass tactics, and fraudulent identity verification scripts to trick victims into handing over banking credentials or one-time passcodes.
This new wave of fraud is consistent with national trends tracked by the Federal Trade Commission (FTC), the FBI’s Internet Crime Complaint Center (IC3), and financial institutions across the U.S.
The Consumer Finance Review Board (CFRB) recently highlighted similar dangers in its major education guide,
“First Steps to Protect Yourself From Phone, Text, Email & Social Media Scams (2025–2026 Guide).”
📲 CFPB: Text Scams Are “More Personal, More Convincing, and More Dangerous”
In its 2025 bulletin, the CFPB warns that scammers now use:
- Stolen personal data purchased from data brokers
- Spoofed bank text alerts
- Urgency-based scripts (“Your account is locked—verify now”)
- Fake fraud department representatives
- Deepfake-style chat responses
These scams target both debit and credit accounts and often rely on victims responding quickly before thinking.
“These texts appear legitimate because criminals already know personal information about the consumer,” the CFPB states.
“This increases trust and lowers skepticism, leading to more successful account takeovers.”
🏦 Bank Account Takeovers Are Growing Faster Than Any Other Type of Fraud
According to recent IC3 data:
- Bank account takeover fraud is up over 200% since 2022
- Text scams are the #1 initial contact method
- Losses from unauthorized transfers continue to rise
- Criminals prefer bank-to-bank (ACH) fraud due to speed
Many attacks follow the same pattern:
- Victim receives a fake fraud-alert text
- Victim responds
- Criminal calls pretending to be bank security
- Criminal requests:
- Online banking username
- One-time passcode
- Debit card details
- Funds are immediately transferred out
This has caused major concerns among regulators, especially for seniors and younger adults using P2P payment services.
🔐 How Criminals Bypass Multi-Factor Authentication (MFA)
Scammers are now using:
✔ “Passcode Harvesting”
Victim is tricked into reading their one-time verification code.
✔ SIM Swap Attacks
Criminals reroute your phone number to their device.
✔ Device Spoofing
Fake “trusted device” requests are pushed to victims.
✔ Social Engineering Scripts
Scammers claim:
- “I’m verifying your identity.”
- “Read me the 6-digit code we just sent you.”
- “This is needed to secure your account.”
Once the passcode is captured, the account is compromised instantly.
CFRB’s fraud-prevention guide explains exactly how these scripts work and why they’re so effective.
📉 Financial Institutions Confirm Record Takeover Attempts
Several major U.S. banks report:
- Customers receiving multiple fraudulent texts per week
- Increased fraud department impersonations
- More account lockouts due to repeated login attempts
- Rising Zelle and ACH transfer fraud
Banks note that criminals target:
- Elderly customers
- High-balance accounts
- Recently relocated consumers
- Anyone with publicly exposed personal information
This aligns with CFRB’s analysis of data broker exposures and privacy risks.
🛡 CFRB: 2025–2026 Will Be a “Critical Period” for Banking Security
According to CFRB analysts, the bank takeover surge is driven by:
✔ Massive personal data leaks
Your phone number, address, bank name, and even income range are sold online.
✔ AI-enhanced impersonation
Bots mimic real bank employees perfectly.
✔ Increased reliance on text alerts
Consumers expect constant notifications from banks.
✔ Weak privacy protection
Most consumers have their data exposed across dozens of brokers.
In CFRB’s scam-prevention guide, readers learn how to:
- Identify fake fraud texts
- Recognize a takeover attempt
- Stop criminals from obtaining passcodes
- Secure mobile banking apps properly
- Reduce exposure through privacy tools
✔ Recommended Protection Tools (From CFRB’s Guide)
- Optery — Full-spectrum data broker removal
- DeleteMe — Monthly personal data deletion
- Kanary — Automated privacy-takedown management
- Aura — Credit monitoring, identity protection, VPN
- LifeLock — Identity theft monitoring suite
These tools reduce your visibility and the amount of personal data criminals can exploit.
🚨 What To Do If You Receive a Suspicious Text or Alert
CFPB recommends:
- Do NOT click the link
- Do NOT respond to the text
- Call your bank directly using the number on the back of your card
- Report fraud to:
- ftc.gov
- ic3.gov
- consumerfinance.gov
📌 Final Takeaway
The CFPB warns that 2025 will be the most dangerous year yet for text scams and bank account takeovers.
Consumers must remain vigilant, verify every alert, and avoid engaging with unsolicited texts — no matter how real they appear.
For step-by-step protection strategies, read CFRB’s full guide:
First Steps to Protect Yourself From Phone, Text, Email & Social Media Scams (2025–2026 Guide).