The Tennessee Bureau of Investigation is issuing a urgent warning to residents and business owners about a dangerous new evolution in banking scams that is robbing victims across the state.

Criminals are now spoofing legitimate bank phone numbers and using U.S.-based callers to trick victims into handing over sensitive account details. By employing native English speakers rather than overseas call centers or AI-generated voices, scammers are able to hold natural conversations that make the ruse significantly more convincing.

How the Scheme Works

The scam typically begins with an incoming phone call that appears to come directly from the victim’s bank. The caller alerts the target to “fraudulent activity” on their account and asks to verify their identity.

During the call, the scammer triggers a system to send a six-digit verification code to the victim’s phone and asks them to read it back.

“That’s actually the most dangerous thing to provide to them because that’s how they’re resetting your online banking password,” said TBI Assistant Special Agent in Charge Nicholas Christian.

While two-factor authentication remains a critical security layer, authorities emphasize that scammers are actively bypassing it by manipulating victims into surrendering these one-time passcodes. Investigators note that callers are often recruited by criminal syndicates and paid specifically to impersonate bank representatives.

Businesses Hit Hard

While anyone can fall victim, the TBI reports that criminals are heavily targeting local businesses—especially those that received Paycheck Protection Program (PPP) loans during the pandemic. Because PPP loan data is public record, scammers combine this information with details harvested from stolen checks to build immediate credibility and trust with business owners.

Christian noted that the financial fallout for local companies has been “devastating.”

How to Protect Yourself

Law enforcement advises taking the following precautions if you receive a call regarding suspicious account activity:

• Hang up immediately: Do not rely on Caller ID, as numbers are easily spoofed.

• Call back directly: Reach out to your bank using the official customer service number printed on the back of your debit or credit card.

• Keep codes private: Never read a six-digit security or authentication code to anyone over the phone. Real banks will never ask for it.

If you believe you have been targeted or lost money to this scam, contact the FBI’s Internet Crime Complaint Center (IC3) immediately. Rapid reporting significantly improves the chances of recovering stolen funds.