“The Bank Is Calling”: 5 Questions That Expose Vishing in 30 Seconds

Short answer: Vishing is phone fraud in which a criminal impersonates a bank employee, a police officer, or a family member to extort money or data. You can expose it in 30 seconds by asking yourself 5 questions: why is this person calling me, why do I have to act right now, why are they asking for something a bank never asks for, how can I check this independently, and what will happen if I hang up. The most important rule: hang up and call the bank yourself, using the number on your card or in your app.

A call from a number that looks like the bank’s. The calm voice of an agent saying that someone is trying to take out a loan in your name right now. That’s how most of the calls that end with an empty account begin. Vishing works not because victims are naive, but because scammers deliberately provoke fear and urgency, and in that state all of us think less clearly. In this guide you get a ready-made defense method, examples of typical scenarios, and a description of how criminals operate step by step.

What vishing is and why the “bank is calling” scam works

Vishing (voice phishing) is the extortion of data or money during a phone call. The name comes from the English words voice and phishing. The criminal doesn’t need to break into the bank’s system, because it’s easier to convince you to make the transfer, give out a code, or install a program yourself.

The most common roles scammers take on

• A bank agent or employee who is “protecting your money” from an alleged break-in or loan.
• A police officer, prosecutor, or government official who is running a “secret operation” and asks for your cooperation.
• A grandchild, son, or daughter who is in trouble and urgently needs cash. Increasingly, the voice may be artificially generated.
• An employee of a courier company, phone carrier, or energy supplier who asks you to “confirm” your details or pay an extra fee.

Why it’s easy to be fooled

Scammers exploit three psychological mechanisms: authority (an institution you trust), fear (losing money, a loved one in trouble), and time pressure (“you have to act now, sir”). With that combination, even people aware of the threats can give out a BLIK code. That’s why an effective defense isn’t “being smarter,” but a simple habit you switch on every time someone calls about money.

5 questions that expose vishing in 30 seconds

The questions below let you recognize vishing. Ask yourself them during the call, or better yet, right after it ends. A single answer of “yes, that’s odd” is enough reason to hang up.

You’ll find more on how to check whether someone really is who they claim to be in the article How to Check Whether an Online Store Really Exists.

Vishing in practice: 5 scenarios and a case study

The scenarios below are illustrative. They describe typical schemes known from bank and police announcements, not specific people. The names are examples.

Scenario 1: “Someone took out a loan in your name” and a remote-access program

Ewa gets a call from a number similar to the helpline number. The agent calmly says that someone is trying to take out a loan in her name right now. To “block the application,” he asks her to install a “verification” app, which is actually a remote-access program. With it, the scammer sees the phone’s screen and can log in to online banking, take out a loan himself, and transfer the funds.

Where the mistake was: banks don’t ask you to install apps like that. How to stop it: hang up as soon as you’re asked to install something, and call the bank yourself.

Scenario 2: “Transfer your money to a safe account”

Mark hears that his account has been hacked and that the agent will “move” his funds to a technical account to secure them. The agent gives an account number and asks him to make the transfer from his own app, then asks for an additional “verification” with a text-message code. The money goes to the criminals and then on through further accounts to make it harder to recover.

Where the mistake was: there’s no such thing as a “safe account” given out over the phone. How to stop it: refuse any transfer to the number provided and call the bank.

Scenario 3: a fake police officer and “help with an operation”

Halina gets a call from a man who introduces himself as a police officer. He says a secret operation is underway against dishonest bank employees and asks her to withdraw her savings “as evidence” or to hand the money over to a courier. The police warn that they never inform people by phone about ongoing investigative activities and never ask for money or valuables.

Where the mistake was: believing in the “secrecy” of the call and the ban on contacting family. How to stop it: hang up and call 112 or the nearest police station, then call someone close to you.

Scenario 4: a “grandchild” after an accident

Józef gets a call from someone who is crying and says: “Grandpa, I’ve had an accident.” A moment later, a supposed police officer joins the call and demands bail. According to bank announcements, an outsider often comes to the door to collect the money. Ending the call and phoning the real grandchild usually settles the matter within seconds.

Where the mistake was: not checking the voice and details through an independent channel. How to stop it: hang up and call the grandchild or their parents yourself.

Scenario 5: a text message with a link, then a phone call

First comes a text message or email with a link to “verify your account,” which leads to a fake login page. A few minutes later, an “agent” calls who already knows your name and your bank, because the details were entered on the fake page. This combination of smishing (text messages) and vishing (phone calls) is described by CERT Polska in its warnings about fake banking websites.

Where the mistake was: clicking the link in the message. How to stop it: log in only through the official app or an address typed in by hand. We write about the rules for recognizing suspicious addresses in the article How to Read a URL and Domain Before You Even Click a Link.

How scammers operate: the anatomy of a vishing call

Understanding the pattern helps you recognize vishing at every stage. Below we describe the five phases of a typical vishing scam and what you can do in each one.

Phase 1: reconnaissance and gathering data

Criminals start with data leaked from databases, from fake login pages, or from social media. A first and last name, the name of your bank, or your phone number make the caller sound credible. If someone knows your name and your bank, that is not proof they’re really calling from the bank.

Phase 2: impersonating an institution (spoofing)

In this phase, the scammer makes a number resembling that of a bank, the police, or a government office appear on your screen. This faking of a number is called spoofing. It’s technically possible, so the displayed number can never be the only criterion for trust.

Phase 3: pressure, fear, and isolation

The caller provokes fear (savings at risk, a loved one’s accident) and sets the pace. They often forbid you from talking to anyone: “this is a secret matter,” “a bank employee may be in on it.” Isolation is meant to cut you off from anyone who could say “this is a scam.”

Phase 4: the extortion in vishing

Only now comes the actual request: giving a BLIK or text-message code, installing a remote-access program, transferring to a “safe account,” withdrawing cash for a courier. This is the moment when the time for thinking runs out. Each of these requests is reason enough on its own to end the call.

Phase 5: covering their tracks

Stolen funds quickly move to further accounts, including those of so-called money mules. The police have described cases in which scammers also took out loans in victims’ names and moved the money out through many accounts. The sooner you report it to your bank, the better the chance of blocking the transaction.

Vishing: what to do at each moment, a step-by-step guide

During a call in which you suspect vishing

• Don’t give out BLIK codes, passwords, text-message codes, or your card number.
• Don’t install anything and don’t change your phone’s security settings.
• Don’t make transfers or withdrawals at the caller’s request.
• Say briefly: “I’ll call back” and end the call. Don’t explain yourself and don’t argue.

Right after hanging up

• Call the bank yourself, using the number on your card, in your app, or on the official website. Don’t call back the number that just called you.
• Check your transaction history and loan applications in the app.
• Block the caller’s number and tell someone close to you about the situation.

If you’ve already given out data or made a transfer

With vishing, every minute counts. Take the steps below in order.

1. Call your bank and ask them to block your cards and online banking access and to try to stop the transaction.
2. Uninstall the remote-access app if you installed it, and change your passwords from another, secure device.
3. Report the matter to the police in person at a station, or by calling the emergency number 112 if the situation is urgent.
4. Restrict your PESEL number to make it harder to take out loans in your name. The service is free, and you’ll find instructions at gov.pl.
5. Report the fake website or message to CERT Polska via incydent.cert.pl.
6. Keep the evidence: the phone number, the time of the call, screenshots, transfer confirmations.

Vishing and your loved ones: how to protect seniors and children

Vishing most often targets people who have less experience with technology or more trust in people. The good news is that a few simple family agreements make the scammers’ job much harder.

Vishing and seniors: how to protect older people

• The “nothing over the phone” rule. Agree that no decisions about money are made during a call that started with someone else phoning.
• A note by the phone. Write down the numbers for the bank, family, and the police. Under stress, it’s easier to call than to search.
• A family password. Choose a word that doesn’t appear on social media. If someone speaks in your grandchild’s voice, only the real grandchild can give it.
• Limits at the bank. Ask for lower daily limits on transfers and BLIK payments, and turn on transaction notifications.
• A conversation without shame. Say plainly that scammers also fool intelligent people, and that reporting an attempt is a reason for pride, not shame.
• Cash for a “courier.” No honest person comes to your home to collect cash on the basis of a request made over the phone.

According to 2020 data from Poland’s National Police Headquarters, seniors lost about PLN 86 million that year to scams including the “grandchild” scam. The data is older, but it shows the scale of a problem that keeps changing and affects new age groups.

Vishing and children and teenagers: how to protect them

• Codes aren’t a game. Explain that no one needs a BLIK code, a text-message code, or card details, not even a “game admin” or a “buyer on OLX.”
• The one-question rule. If someone asks for something and is in a hurry, the child says: “I’ll ask my parents” and ends the conversation.
• Limits and supervision. Set low limits on cards and payment apps, and turn on notifications for the parent.
• No punishment for reporting. A child who fears your reaction will hide the problem. Promise that there will be no punishment for reporting a scam attempt.
• A talk about their online image. Voice recordings and videos posted online can be used to clone a voice, so it’s worth limiting public access to them.

We write about teaching children to verify information online in the article How to teach a child to search for information in the era of TikTok and Reels.

A family protocol in case of an attack: vishing

Write down three rules on a single sheet of paper: I hang up, I call back myself, I don’t give codes to anyone. Add a family password and the numbers you call when in doubt. A sheet of rules like this for a vishing situation takes 5 minutes to make, and it can save a lifetime of savings.

Frequently asked questions about vishing

Want to search and verify even more wisely?

More from our blog

See all blog posts →

Sources: PKO Bank Polski, “Watch out for phone scammers” (pkobp.pl); CERT Polska, announcement “Beware of scams using banks’ likenesses” (June 2026, moje.cert.pl); the Police and the Central Cybercrime Bureau, announcement about a dismantled group that extorted funds using the “bank employee” method (data from 2022–2024); Bank Polskich Spółdzielczości, announcement “Grandchild and police officer scams are still dangerous”; Radio Kraków, a discussion of National Police Headquarters data on seniors’ losses in 2020. If you suspect fraud, report it to your bank and the police. This guide is for informational purposes and does not replace legal advice.