A caller who claims to be from your bank’s fraud team can sound calm, informed and urgent at the same time. They may use the name of a high-street bank or building society. They may quote the last digits of a card or account. That does not prove they work for the bank. It often means they have pieced together details from a leak, a previous scam, or a guess that sounds close enough.
Hang up if the story does not feel right. You can always call the bank back on a number you already trust. In the UK you can also call 159, the dedicated number that connects you to your bank’s fraud team. Do not use a number the caller reads out, texts, or puts on your screen.
How the fraud-team script usually works
The call often starts with a warning. Someone has tried to take money from your account. A payment is about to leave. A card has been cloned. The caller may ask you to confirm that you did not make a purchase. That question is designed to put you on their side.
They then offer to “protect” you. The common next step is a request to move money to a “safe account”. They may say the safe account belongs to the bank, to the police, or to a holding service. Genuine UK banks do not ask you to transfer your savings into a new account that they dictate over the phone.
Another version keeps the money where it is but harvests access. The caller asks for a one-time passcode from a text, an authenticator app, or a banking notification. They may call it an OTP, a confirmation code, or a “cancellation PIN”. Those codes are keys. Anyone who has the code can often approve a payment or add a new payee.
Some scripts mix both. You are talked into adding a payee, then asked for the code that confirms it. If you stay on the line, you are less likely to pause and check.
Why they seem to know your last digits
Fraudsters do not need your full card number to sound official. Last four digits appear on receipts, packing notes, and some phishing pages. Partial account details leak from data breaches. A previous scam may already have collected a slice of your information.
Treat partial knowledge as a trick, not as proof. A real bank staff member who needs to verify you will not rush you into a transfer. They will not ask you to install remote-access software. They will not tell you to keep the call secret from family.
If you are unsure, end the call. Look up the number on WhoCalledMe. Search it as it appeared on your screen. Community reports can show whether other people heard a similar story. Reports are not proof that a crime took place. They are a warning that the number, or a number like it, has been used in a worrying way.
The stay-on-the-line callback trick
A practised caller may invite you to “check” by ringing the bank yourself. They tell you not to hang up. They ask you to use another phone, or to put them on speaker, while you dial. Sometimes they claim they will transfer you.
Stay-on-the-line tricks work because the original call never ends. The second phone may still be connected to the fraudster. A “transfer” may simply be the same person with a different accent. If you must check, hang up fully. Wait a moment. Use a number from the back of your card, a paper statement, or the bank’s official website that you typed yourself.
Calling 159 is designed for this situation. It is a short UK number that takes you to participating banks’ fraud teams. Use it from a phone you control, after the suspicious call has ended.
Remote access is not a bank check
Some impersonation calls shift into a tech-support story. The caller says they need to see your screen to reverse a payment. They ask you to install AnyDesk, TeamViewer, or a similar tool. Once they can see the screen, they can watch you open your banking app. They can talk you through adding a payee. They can read codes as they arrive.
UK banks do not ask you to install remote-access software during an unexpected call. If you already installed it, disconnect from the internet if you can do so safely, uninstall the software, and contact the bank from another device. Change important passwords from a device the caller never saw.
Take Five, and the overlap with APP fraud
Take Five is a simple UK habit: stop, challenge, and protect. Stop the conversation. Challenge the story by using a contact method you already trust. Protect your money and your codes.
Bank impersonation often overlaps with authorised push payment (APP) fraud. In an APP scam you send the money yourself. The bank’s systems may show a transfer you confirmed. That is why the caller works so hard to keep you calm and compliant. They want you to authorise the payment.
If you have already sent money, contact the bank at once. Say you believe it is APP fraud or a bank impersonation scam. Speed matters. Do not wait because you feel foolish. Embarrassment is part of the design. Many people freeze after they realise what happened. The caller may even ring back to soothe you, or to ask for a second transfer “to reverse the first one”. Do not send more money.
What to write down, and what never to store
After you hang up, make a short note while the details are fresh. Write the time of the call. Write the number that showed on the screen. Write the name they used for the bank or “fraud department”. Note what they asked you to do: move money, read a code, install an app, stay on the line.
Do not write down full card numbers, PINs, passwords, or one-time codes. Do not photograph the back of a card “for the report”. Those details help a thief more than they help anyone else.
If the same person rang from more than one number, keep each number in the same note. On WhoCalledMe, search each number, then put them all on one factual report. Describe the script, not your account. Say they claimed to be a fraud team. Say they asked for a safe-account transfer or an OTP. Do not paste screenshots of banking apps or texts that show balances.
A factual report helps other people recognise the pattern. It does not name a private individual as a criminal. Caller ID can be spoofed, so the number on the screen may not belong to the person who spoke.
If you shared a code or moved money
Contact the bank using 159 or a number from your card. Tell them what was said and what you did. Ask them to watch the account for new payees and devices. If a card was discussed, consider a freeze or replacement through official banking channels.
Report the fraud to Action Fraud when you are able. GOV.UK’s Stop Think Fraud pages explain the wider picture in plain language. If you are in immediate danger, call 999. If you need the police for a non-emergency crime, 101 is the usual route.
Tell someone you trust. A second person can help you slow down if the caller tries again. Scam calls often come in clusters. The next call may use a new number and the same story.
Block the number on your phone if that helps you feel safer. Blocking is a practical step, not a finding of guilt. If a new number appears with the same script, search it on WhoCalledMe and add it to the same report as the earlier ones.
You do not have to prove anything on the first call. You only have to stop, hang up, and use a contact path you chose yourself.
Common warning signs
- The caller asks you to move money to a “safe account”.
- They want a one-time passcode, PIN, password or full card number.
- They ask you to install AnyDesk, TeamViewer or similar software.
- They tell you not to speak to family, friends or staff in a branch.
- They keep you on the line while you “call the bank back”.
- They claim police or the bank will arrest you if you hang up.
- They ring again from a different number with the same script.
What you should do
- Hang up. Do not argue or explain yourself.
- Call your bank on a number from your card, statement or official website — not a number the caller gave you.
- You can also call 159 to reach your bank’s fraud team.
- Never share codes, PINs or passwords.
- If you have already moved money or shared details, contact your bank at once and report it to Action Fraud.
- If they used more than one number, add every number on one WhoCalledMe report.
