If the cell phone shows a number that you recognize as belonging to the bank, this is not enough to conclude that the call is genuine. Scammers can mask the origin of the call, a technique known as spoofing, and make the screen display an official number or one similar to that of the institution. The safest way to decide is not to rely on a single signal, but to combine the type of identification that appears on the display with what the person asks for during the conversation.
The rule of thumb is simple: a common number on the display is just a clue. An authentication seal, when available, is a stronger indication of origin. Even so, no on-screen identification should lead you to provide a password, token, security code, install an application or move money to “solve” a problem. When any such request arises, end the contact and contact the bank through a channel you initiated yourself.
The number on the display alone does not prove origin
ENCCLA's diagnosis of false exchange scams describes telephone spoofing as a technique used to mask the origin of the call and make a reliable number appear on the identifier, including that of a financial institution. Febraban also warns, in guidance published in July 2026, that criminals simulate official bank numbers to give credibility to the approach.
This changes the question you should ask. Instead of “is the number for the bank?”, think “is the call authenticated or just a number displayed?”. If it's just the traditional identifier, even if the number is identical to what appears on the website or on the back of the card, treat the call as unverified.
The scammer may also know your name, agency, part of the card, CPF or purchase details. The ENCCLA diagnosis notes that these approaches can use previously obtained personal information to make the conversation more convincing. Therefore, knowledge about yourself also does not work as proof of legitimacy.
What “Validated Number” really means
Anatel maintains a call authentication and identification system in Brazil based on protocols such as STIR/SHAKEN and RCD. In an authenticated call, operators verify the origin and can deliver enriched data to the cell phone, such as company name, number, visual seal, logo and reason for contact. Depending on the device, the text “Number Validated” may appear.
This seal is different from the simple caller ID. According to Anatel, it indicates that the origin of the call was verified by the operators involved in the traffic and that the number displayed was actually used to originate the call. In practice, this precisely reduces the problem of a criminal forging the number and pretending to be the bank just on the display.
But the seal does not transform the call into authorization to ignore basic security rules. Authenticating the origin helps you know where the call came from; does not change the fact that a password, token, transfer to a “secure account” or application installation are requests that are incompatible with industry anti-fraud guidelines. If the content of the conversation contradicts these rules, end the contact and validate through another channel.
Appearance also varies. Anatel informs that identification depends on smartphone compatibility, 4G or 5G network, VoLTE, updated system and voice network support. Some devices display more elements than others.
No seal can also be a legitimate connection
You can. Anatel itself states that authentication and identification are being progressively implemented. Therefore, legitimate calls can still arrive without a seal, without a logo or without the expression “Validated Number”. The absence of these elements is not automatic proof of fraud.
This point avoids the opposite error: thinking that every connection without authentication should be discarded as false. What changes is the level of trust. Without a seal, you do not have technical confirmation of the origin and must depend even more on the second filter: what they are asking for and whether you can validate the situation through an independent channel.
The second filter: what they are asking for
Febraban informs that banks can contact you to confirm suspicious transactions. This means that a call about a non-standard purchase, for example, is not automatically a scam. The watershed is the procedure required from the customer.
The bank can confirm a transaction
A legitimate contact may aim to find out whether you recognize a certain purchase or movement. Banco do Brasil, in its own guidance, gives as an example a simple confirmation of “yes” or “no” to find out whether the operation was carried out by the customer. The exact format varies by institution, but the idea is that confirmation does not depend on you revealing credentials or executing a new transaction.
If you are not comfortable with even this confirmation, there is no need to resolve everything during the incoming call. You can disconnect and check the application, card or the bank's official center on your own.
Password, token and codes are left outside the connection
In Febraban's guidelines, banks should not call asking for a password, token, security keys, personal or financial data to resolve a suspicion. Itaú and Banco do Brasil publish guidelines to the same effect on their security channels.
There is an important difference between a call that the bank initiated and a service that you initiated. When you search for the institution through an official channel, there may be specific authentication steps in the application, in the URA or in customer service. This does not justify, however, handing over credentials to someone who called you unexpectedly. If the supposed attendant says they need to “validate your identity” with a password, token or code, end the call and resume contact via the official channel.
“Secure account”, Pix and refund over the phone
The false center usually turns an invented threat into urgent action. The script might say that your account has been hacked, that an employee is under investigation, or that your money needs to be transferred to a “secure account.” ENCCLA and Febraban describe these variations as part of the scam.
Banks do not advise customers, in an incoming call, to transfer funds to protect their balance. They also do not ask for test Pix, payment, manual reversal or movement to cancel a suspicious operation. If the proposed solution to a fraud requires you to move money, stop immediately.
Application and remote access: end contact
Another common version is the false technician. The attendant says he needs to check his cell phone, do a scan, update a security module or access the account remotely. ENCCLA documents the use of legitimate remote access programs in these scams, and Febraban advises that banks do not ask for the installation or updating of applications during the approach.
Do not install an application recommended by the caller, do not share your screen and do not grant remote access permission. Even if the application exists in an official store, the tool may be legitimate and the use requested by the scammer may not be.
How to validate without depending on the call received
You don't need to “unmask” the person on the other side or prove that they are a scammer. The safest procedure is to cut dependence on that call.
Shut down. Then, open the banking application using the icon already on your device or enter the institution's official address yourself. If you prefer to call, use the number printed on the card or published within the app and on the official website. Do not use a telephone number sent by SMS, WhatsApp, email or by the attendant himself to “continue the case”.
When reopening contact, describe what happened without assuming that the first call was genuine. Say that you received contact about a certain purchase, access or movement and want to check if there is any real alert on the account. This way, the new conversation starts on a channel whose origin was chosen by you.
If the first call had an authentication seal, you can still follow the same procedure. The seal increases confidence in its origin, but you still have the right to interrupt the conversation and confirm the request through another channel, especially if something seems out of line.
Four common scenarios
“We detected a suspicious purchase”
This is a plausible reason for a bank to get in touch. The safe answer is to only confirm acknowledgment of the operation if you feel comfortable, without providing credentials. If you are asked for a password, token, full card number, security code, Pix or app installation, stop. Then, check the transaction in the app or look for the official center.
“Send to a secure account”
End the call. Febraban is explicit in saying that banks do not request transfers to resolve account problems. The idea of “protecting” the money by moving it to an account indicated by the attendant is a classic pattern of the false exchange.
“Swipe token to cancel”
Do not enter or enter codes under the direction of the caller. Tokens, keys and temporary codes exist to authorize sensitive actions. A scammer may try to make you confirm, without realizing it, the very transaction he wants to execute.
“Install this app”
Do not install. The fake center can use remote access applications to take control of the device, monitor what appears on the screen and carry out operations. Hang up and talk to the bank on another device or through an official channel if there is any suspicion that your cell phone has been compromised.
If you have already provided data or moved money
If you noticed the scam after sharing data, installing an application or making a transfer, the priority changes from verification to containment. Contact the bank as soon as possible through an official channel and inform them exactly what was provided and what operations were carried out. Febraban advises that the institution be notified immediately to allow additional security measures, such as blocking access or credentials.
If there was a transfer via Pix related to fraud, ask your bank to dispute it using the mechanisms available for fraud. The Central Bank maintains the Special Return Mechanism, the MED, for cases of well-founded suspicion of fraud with Pix. Rapid activation increases the chance of resources being blocked, but should not be understood as a guarantee of full value recovery.
If you have installed a remote access application, do not continue operating the account in the same environment until you assess the risk. Interrupt the device's internet access if necessary, contact your bank for another reliable device and consider a technical check before using your cell phone again for financial transactions.
It is also recommended to register a police report when there is actual fraud or loss, preserving receipts, numbers used, times, messages, receipts and transaction data. These records help both the financial institution and any investigation.
The decision in 30 seconds
If only the bank number appears, do not treat this as evidence: spoofing can reproduce the identifier. If an authentication seal or “Validated Number” appears, consider this a stronger technical sign of origin, remembering that the technology does not yet appear on all calls and devices.
Then ignore the name on the display for a moment and look at the order. Confirming that you recognize a transaction may be part of a legitimate contact. Providing a password, token, code, personal data, making Pix, transferring to a “secure account”, making a chargeback, installing an application or granting remote access should not be part of the solution for an incoming call.
When any piece doesn't fit, the safest solution is not to continue investigating with the attendant himself. Hang up and reopen contact via the app, card number or official website that you accessed on your own. This step breaks the main advantage of the false center: controlling the story, the channel and the urgency at the same time.
