A fake bank called me: how to spot it and what to do

How the scam works

The script barely changes from one victim to the next:

1. Someone calls from your bank's "fraud team" – or from the police, a regulator or a government agency. They say they've spotted suspicious payments, a loan taken out in your name, or that your account is about to be frozen.
2. They create urgency. You may be passed on to a "specialist" or a "police officer", so it feels like several people are involved. Calls drop and come back, so you never get time to think.
3. They offer a "solution": move your money to a new "safe account", read out a verification code "to cancel a payment", withdraw cash or buy gift cards or crypto, or install an app so they can "check your device".
4. The money is gone. You authorised the payment yourself, which is exactly what makes it hard to get back.

The app variant is particularly nasty. Remote access tools let the scammer see and control your phone or computer – including your banking app and every code that arrives.

Things a real bank will never say

If you hear any of these, it's a scam. Hang up.

• "Move your money to a safe account to protect it." The FTC puts it bluntly: never move or transfer money to "protect it" – your money is fine where it is, no matter how urgently the caller insists. If your account really were at risk, your bank would block it itself.
• "Read me the code we've just sent you." The FTC says never to share a verification code, ever – no caller, least of all someone from your bank's fraud department, will ask for it. The UK's Take Five campaign lists a request for a one-time passcode, password or PIN as a key warning sign.
• "Install this app so we can help you." No genuine bank needs to control your device to protect your account.
• "Withdraw cash, buy gift cards or send crypto." Banks don't protect money this way. Scammers ask for these because the money can't be traced or recalled.
• "Don't tell anyone, not even staff at your branch." Pressure to act fast and in secret is a hallmark of fraud. As Take Five says, only criminals will try to rush or panic you.

The number on your screen proves nothing

Scammers can fake the caller ID (this is called spoofing), so the screen may show your bank's real number. A caller who knows your name, address or the last digits of your card isn't proof either – that information leaks in data breaches.

The only reliable rule: hang up and call your bank yourself. Use the number on the back of your card, on your statement or in the official app. Never use a number the caller gives you – the FTC warns it will take you straight back to the scammer.

Already did something? What to do now

Speed matters. The sooner your bank acts, the better the chance of stopping or recovering the payment.

1. End the call and don't take any more calls from the "bank" or the "police".
2. Call your bank on a number you trust (or 159 in the UK). Tell them exactly what happened: payments made, codes shared, apps installed. Ask them to block your card and online banking and to try to recall the payment.
3. Installed a remote access app? Disconnect the device from the internet, uninstall the app and run a security scan. Don't use online banking on that device until it's been checked or reset. Change your passwords from another, clean device. More in Tech support scam: what to do.
4. Go through your account with your bank: payment limits, new payees, newly linked devices, standing orders. Scammers often get victims to set these up during the call.
5. Paid another way? For a wire transfer, contact the transfer company immediately. For gift cards, call the issuer on the number on the back of the card and keep the card and receipt. For crypto, contact the exchange or ATM operator. The FTC points out that crypto payments don't have the same legal protections as card payments.
6. Typed your details into a website as well? Follow Entered your details on a phishing site.

Can you get the money back?

In the UK

Since 7 October 2024, the Payment Systems Regulator's reimbursement rules cover people tricked into sending a bank transfer (Faster Payments or CHAPS) from one UK account to another – this is called authorised push payment (APP) fraud. According to the PSR:

• the maximum claim is £85,000 (firms can choose to pay more),
• your bank may deduct an excess of up to £100, but not if you're a vulnerable customer,
• report the scam as soon as possible and within 13 months of the payment,
• your bank can refuse only if you were in on the fraud or were grossly negligent – which the PSR calls "a high bar",
• most victims should be reimbursed within five business days.

Card, cash and cheque payments aren't covered by these rules – they have their own protections. If you're unhappy with your bank's decision, you can take your case to the Financial Ombudsman Service free of charge.

In the US

The FTC warns that bank accounts have fewer protections than credit cards, and that if you're tricked into moving money out of your account you probably won't get it back. Contact your bank or credit union immediately anyway, especially if you moved money or shared a code, and ask it to reverse the payment.

Report it

• UK: report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (England, Wales and Northern Ireland). In Scotland, contact Police Scotland on 101. Forward scam texts free of charge to 7726.
• US: report it to the FTC at ReportFraud.ftc.gov.
• Elsewhere: contact your bank first, then your local police.

Have the details ready: the number that called, the times of the calls, the account details you paid to and your bank statement.

Protect yourself in advance

• Talk to your parents and grandparents: "Your bank or the police will never ask you to move money or install an app. If anyone calls, hang up and ring me." Older people are a frequent target. Scammers also pose as family – see the "Hi Mum, I've got a new number" scam.
• Set sensible payment limits in your banking app. Having to raise a limit is one more moment to stop and think.
• Check suspicious links without opening them with our link checker, and check where a suspicious email really came from with the email header analyzer.