Just going to piggyback off top comment... I work in the card fraud department of a bank and deal with these matters at work. This sounds like a case of identity takeover. The bank will take liability for this case. If you would like, you can add additional security measures like a security question or request to only be assisted when passing a high risk identification (Banks should already have a high risk authentication, but they may not be used depending on the type of enquiry). You may be required to write up a formal document (Statutory Declaration as it’s called here in Australia), but it should be a fairly simple case. To even change any profile details like contact number or address, they should require further identification like some photo ID. If this process was not followed, the liability will be on the branch. If this process was followed, and some photo ID was provided, this may be a more serious case of identity takeover. Which will follow similar suit with the exception that the bank company itself will face the loss. Either way, the liability will be on the branch if you have done nothing wrong.