The phone rings. It's “your bank”, the fraud team, and they've spotted suspicious payments on your account. They know your name, maybe your address and the last few digits of your card. The number on your screen even looks like your bank's. They need you to act quickly to protect your money.
This is one of the most common scams in the UK, and it catches careful, sensible people because it's built to. The good news is that one simple habit beats it every time: hang up, and ring your bank yourself. Here's why, and how to do it properly.
How the scam works
- They fake the number. Criminals can make almost any number appear on your phone, including your bank's real one. A familiar number proves nothing.
- They already know things about you. Names, addresses, even partial card numbers leak in data breaches and get sold. Knowing them doesn't make someone your bank.
- They create panic. Your money is at risk “right now”, the criminals are “still in your account”, and the call mustn't end.
- Then comes the ask. Move your money to a “safe account”. Read out a code that's just been texted to you. Confirm your PIN or password. Install an app so they can “fix” your phone. Hand your card to a courier.
What your real bank will never do
- Ask you to move money to a “safe account”. There is no such thing. Take Five, the national anti-fraud campaign run with the banks, lists this as a top warning sign.
- Ask for your PIN or full password over the phone, by email or in writing.
- Ask you to read out a one-time code sent to your phone. Those codes are for you to type in, never to say aloud.
- Send a courier to collect your card or cash. Age UK is blunt about it: your bank would never do this.
- Rush you. A genuine bank will always be happy for you to hang up and call them back.
If a caller asks for any of those, you don't need to work out whether it's real. It isn't. Put the phone down.
How to check: the right way to call back
- Hang up. You don't owe them politeness or an explanation.
- Call 159, or the number on the back of your card. 159 is a short number run by Stop Scams UK that connects you straight to your bank. It works with the big UK banks, including Barclays, Halifax, HSBC, Lloyds, Monzo, Nationwide, NatWest, Santander, Starling, TSB and many more, covering over 99% of personal current account holders. Because it's so short, it can't be spoofed.
- Use a different phone, or wait. This bit matters. Scammers can sometimes keep a landline connected after you hang up, so when you “call your bank”, you're actually still talking to them. Age UK's advice: use a different phone, call someone you know first to check the line is clear, or wait at least 10 to 15 minutes before calling.
- Never use a number the caller gives you, or one from a text or email they've just sent. It goes straight back to them.
If you've already given details or moved money
Move fast and don't be ashamed. These criminals are professionals, and banks deal with this every day.
- Ring your bank immediately using 159 or the number on your card (from another phone if you can). Tell them exactly what happened. They may be able to stop or recall a payment, and they'll lock your account and cards.
- Report it. In England, Wales and Northern Ireland, report to Report Fraud (the service that replaced Action Fraud), online or on 0300 123 2040. In Scotland, call Police Scotland on 101.
- Change passwords for your online banking and email, and uninstall any app the caller asked you to install.
- Keep notes: the time of the call, what was said, the number shown, and any payments you made.
Can you get your money back?
Often, yes. If you were tricked into sending a bank transfer (what the industry calls an “authorised push payment” or APP scam), UK rules that came in on 7 October 2024 mean your bank should normally reimburse you. The Payment Systems Regulator sets out the key points:
- It covers bank transfers made by Faster Payments or CHAPS from one UK account to another, for individuals, microenterprises and charities.
- You can claim up to £85,000, which covers over 99% of cases.
- Report it as soon as possible and within 13 months of the payment.
- Banks can deduct an optional £100 excess, but not from vulnerable customers.
- You should normally be reimbursed within 5 business days (up to 35 if the bank needs more information).
- It doesn't cover card, cash or cheque payments or international transfers, and you won't be reimbursed if you were “grossly negligent” or in on it.
Card payments have their own protections (chargeback, and section 75 for credit cards), which we explain in how to spot a scam website.
Fewer of these calls in the first place
- Register your numbers with the Telephone Preference Service: here's how. It stops legitimate marketing calls, so what's left is easier to spot.
- Block numbers that keep trying.
- Agree a rule with family, especially older relatives: “If anyone rings about your money, hang up and call me or 159.” Scammers rely on people deciding alone, under pressure.
The same tricks turn up by email and text too: see how to spot phishing.