Key takeaways

Hang up, then contact the organisation yourself using a number you find independently. Never use contact details the caller gives you.

  • The FTC says you cannot rely on caller ID, because it can be nearly impossible to tell whether the information shown is real.
  • Scamwatch lists payment requests, passwords, PINs, one-time codes, and remote access as signs a call is a scam.
  • Real government employees do not call unexpectedly to demand money or account details, according to the FTC.

Got a name, website, or phone number from the sender? Check the scam directory.

How vishing and callback phone scams work

Vishing is voice phishing: a scam carried out by phone. Scamwatch says scammers phone people while pretending to be well-known organisations, such as government bodies, law enforcement, banks, or telecommunication providers. They create urgency to pressure you into acting fast, often to get your personal or bank details or remote access to your computer. They may already know some details about you, like your name or address.

The caller ID is part of the trick. The FTC explains that scammers use technology to change the number that appears, so a call can seem to come from a bank, a police station, or an agency you trust. Its advice is not to rely on caller ID to verify who is calling.

In a callback scam, the caller or a message gives you a number to ring back. The FTC’s guidance covers it: do not call a number the caller gave you or the one shown on your caller ID. Look up the organisation’s number yourself, on your account statement, on the back of your card, or on its official website.

Seven warning signs

  1. A request for payment, transfers, or card or bank details. Scamwatch says a call is probably a scam if the caller asks for payment, money transfers between accounts, or card or bank details, including to process a refund.
  2. A request for passwords, PINs, or one-time codes. Scamwatch lists these explicitly. A code sent to you is meant for you only. See SIM swap and account takeover scams.
  3. A request to install software or give remote access. Scamwatch says to never give anyone remote access to your computer. See tech support scams.
  4. Threats of arrest, deportation, or blackmail. Scamwatch says to hang up on anyone who threatens or intimidates you. See government impersonation scams.
  5. Claims that you or your accounts were hacked or used in fraud. Scamwatch lists this as a sign. The caller then offers to “fix it” by moving your money or taking control of a device.
  6. Payment by wire, reloadable card, or gift card. The FTC says not to wire money or send funds with reloadable cards to unexpected callers. See gift card scams.
  7. Pressure to act now. The FTC treats urgent demands as a warning sign and says to hang up.

How to check a call in two minutes

  1. Hang up. You do not owe the caller politeness, and Scamwatch says to hang up if you are unsure who is calling.
  2. Do not call the number the caller gave you, and do not trust the number on your screen. The FTC advises against both.
  3. Find the organisation’s number yourself: your account statement, the back of your card, or its official website, which you type in. For government, the FTC advises checking the official .gov website for contact details.
  4. Ring that number and ask whether there is a real issue on your account.
  5. Tell someone you trust. A second opinion breaks the pressure, which is what the call depends on.

If you already paid or gave details

Act quickly on what you shared. These steps follow Scamwatch and the FTC.

  1. Contact your bank or card provider immediately. Report the scam and ask them to stop any transactions, as Scamwatch advises.
  2. Change passwords on important accounts, including banking, email, and government services. Turn on two-factor authentication.
  3. If you gave remote access, update your security software, run a full scan, delete what it flags, and change your passwords, as the FTC advises.
  4. If you paid by gift card, wire, or crypto, contact the issuer or provider right away and ask for a reversal. See the FTC’s steps by payment method.
  5. If you shared ID details, get identity support where you live. In Australia, IDCARE offers free help on 1800 595 160.
  6. Do not pay a “recovery” service. See recovery scams.

Where to report

More help from official sources

Scambaba is an independent educational project. Reporting and recovery options depend on where you live. How these guides are researched is on the editorial policy.

Frequently asked questions

What is vishing?

Vishing is voice phishing: a scam carried out by phone. Scamwatch describes callers who pose as banks, government bodies, or other trusted organisations and use urgency to get personal details, money, or remote access.

Can I trust the number on my caller ID?

No. The FTC says it can be nearly impossible to tell whether the caller ID information is real, because scammers can change the number that appears.

Should I call back the number they gave me?

No. The FTC advises against calling a number the caller gave you or the one on your caller ID. Look up the organisation’s number yourself.

Will the Do Not Call list stop these calls?

Not reliably. Scamwatch says scam calls can still reach people with private numbers or on the Do Not Call Register.

I gave a one-time code. What now?

Call your bank or the service on a number you find yourself, change the password, turn on two-factor authentication, and report the scam.