"Your account has been hacked": the anatomy of bank impersonation

Status in the Hebrew source article: police were investigating as of June 2026. When the Hebrew article was reviewed on 22 October 2026, it noted that no arrest or indictment had been reported. This is a translation of that dated account, not a new check of the investigation. Anyone suspected or charged is presumed innocent unless convicted by a court.

The call sounded like an ordinary bank call. A polite representative claiming to be from Bank Hapoalim calmly told Ariel, a pseudonym, an autistic resident of Israel's Sharon region, that his account had been hacked. To "fix" it, the caller needed his username and password. Ariel gave them.

Soon afterwards, an unexplained sum appeared in his account. According to ynet's report, the impersonator had taken out a loan of NIS 250,000 in his name. By the time the branch spotted unusual activity and froze the account, about NIS 130,000 had disappeared.

The published account described how the money left: transfers of thousands and tens of thousands of shekels to different people, NIS 14,000 with an innocent description, "a birthday for a friend who helped me", NIS 20,000 for a vehicle and another NIS 20,000 in three transfers, also for a vehicle.

The impersonator did not disappear. He kept calling and asked for Ariel's new password after it had been changed. He told him to download a vehicle app and photograph both sides of his driving licence, supposedly to get the money back. According to the report, only the licence's expiry prevented further use.

With the account frozen, routine payments were bouncing. The caller continued to use different roles: a bank representative, security staff or a bank manager. Ariel filed an online police complaint, attended the station with documents and an investigation was opened.

The bank said it was supporting the customer. It reiterated that customers should not share codes or login details, click links or install software at a caller's request.

What I see as an investigator

The sequence matters. First, social engineering creates pressure: "your account has been hacked". Then a loan creates new money in the victim's name. The attacker does not need you to have money in the account to steal from you.

Next comes dispersal: medium-sized transfers with innocent descriptions, including a vehicle purchase. A vehicle can be converted back into cash. My reading is that the steps were designed to avoid standing out.

The repeat contact is particularly important. Once someone has been exploited, the attacker may return in different disguises. The request for a licence photograph also extends the exploitation: an identity document may support another fraud attempt. These are investigative interpretations of the reported sequence, not findings by a court.

Key takeaways

Do not share a password or verification code during a call you did not initiate, even if the caller says they are from your bank. Hang up and contact the bank independently using an official number.

If you have been affected, report it to your bank and the police promptly. Early reporting may help stop further loss, but it does not guarantee recovery. Tell someone close to you. Silence can give the attacker more room to keep exploiting the situation.

The question I would ask

What in the first conversation could signal that a victim might disclose a password? What does the renewed contact, even after the password changes, tell us about the exploitation?

Source: ynet, 21 May 2026. Hebrew article last reviewed: 22 October 2026. Translation prepared for review: 27 October 2026. Found an update or an error? Suggest a correction or source.

Amounts marked NIS are in Israeli shekels.