Call center impersonation and wire approvals: what controls still fail?

TL;DR: Account takeover through impersonation of financial institution support accounted for roughly 4,700 complaints and $359.7 million in losses in 2025, while business email compromise reached $3.05 billion and 86% of those losses moved by wire or ACH, according to Trusona’s analysis of FBI IC3 data. The control gap is no longer login security but verification of the conversation itself, especially in customer support and payment approval flows.

Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “Account takeover protection for financial services: call centers, wire approvals, and the calls in between”.

By the numbers:

• The FBI’s 2025 IC3 report cites roughly 4,700 complaints and $359.7 million in losses for account takeover fraud via impersonation of financial institution support.
• The IC3 2025 Annual Report recorded $3,046,598,558 in business email compromise losses across 24,768 complaints.
• The same report says 86% of business email compromise losses moved by wire transfer or ACH.

Key questions

Q: What fails when banks rely on call-centre judgment instead of verification?

A: The failure is that a human agent becomes the last line of identity assurance without a reliable proof channel.

Q: Why do impersonation attacks create such high fraud losses in financial services?

A: They target a high-value decision point where access, money movement, and account changes can be authorised by a person in real time.

Q: What are the signs that bank account verification is failing in practice?

A: Common signs include repeated verification failures, delayed onboarding, incorrect account holder matches, high customer drop-off, and a growing number of payment reversals or manual exceptions.

Practitioner guidance

• Define verification for high-risk calls Classify support callbacks, password resets, wire approvals, and bank-detail changes as security-controlled interactions with explicit approval rules and audit requirements.
• Add customer-facing outbound verification Use a separate confirmation path that lets customers independently validate inbound calls from the institution before any account change or payment action proceeds.
• Stop relying on voice or caller-ID trust Treat a familiar voice, a spoofed help desk number, or correct account details as insufficient evidence of identity in support and payment workflows.

Bottom line: Financial services fraud control now needs to verify the conversation itself, because impersonation of support and approval channels can bypass strong login security.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →