Bank Impersonation Scams: How Fraudsters Sound Exactly Like Your Bank

The call that knows your name

The phone rings, and the person on the other end is calm, professional and apologetic. They are from your bank's fraud team, they say, and they have spotted a suspicious payment on your account — did you just try to send £900 to an account in another city? You did not. Good, they say, you have caught it in time; but to protect your money while they investigate, you will need to move it to a secure holding account they will set up for you right now. They are helpful, they are patient, and the number showing on your screen is your bank's real number.

None of it is true except the fear. Bank impersonation is among the most damaging scams operating in Britain because it turns the institution you trust most about money into the very voice telling you to lose it. Worse, the fraudster does not steal your money — they persuade you to send it yourself, which makes it far harder to reverse. This article shows how the illusion is built, the specific things a real bank will never ask of you, and the single rule that dismantles the whole scam no matter how convincing the caller.

Why the number on your screen proves nothing

The instinct that undoes people is a reasonable one: the caller ID matched the bank, so it must be the bank. It does not follow. Fraudsters can make a call or a text appear to come from almost any number or name they choose — a trick usually called number or caller-ID spoofing — so the digits on your screen can be your bank's genuine switchboard while the person speaking is a criminal in a call centre. The same applies to text messages: a spoofed sender name can drop a scam message straight into the same thread as your real bank texts, sitting directly beneath legitimate ones as if it belonged there.

Once you accept that the number can lie, the ground shifts usefully. It means that no incoming contact — call, text or email — can prove who it is by the number or address it appears to come from. The only identity you can rely on is one you reach yourself, on a route you chose. That single idea is the foundation of every defence below.

The playbook

Bank impersonation scams vary in detail but tend to follow one arc. It begins with alarm: a call, text or email warning that your account is under attack, that a payment or a new device needs approving, or that fraud has been detected. The alarm is designed to flood you with urgency and switch off deliberation. Then comes the trusted rescuer — the caller positions themselves as the person helping you against the threat, which is why you end up treating them as an ally rather than a suspect.

From there the demand takes one of a few familiar forms. The most dangerous is the "safe account": you are told your money is at risk where it is and must be transferred to a new account for protection. That transfer is the scam — the "safe account" belongs to the fraudster, and because you authorised the payment yourself, the money is gone the moment it lands. This is what the industry calls authorised push payment fraud, and it is the reason moving money on the say-so of an inbound call is so ruinous. Other versions ask you to read back a one-time passcode "to verify your identity", to hand your card and PIN to a courier sent to collect them, to withdraw cash or buy gift cards, or to install an app that hands the caller remote control of your device. Every route ends with your money or your access in someone else's hands. The emotional levers are the same ones behind fake delivery texts and phishing emails — urgency, authority, a helpful hand — just delivered down a phone line.

What a real bank will never ask you to do

Because the scam mimics your bank so closely, it helps to hold a short list of things a genuine bank simply does not do. If any of these is asked of you, the request is fraudulent, full stop — however official the caller sounds and whatever number appears on your screen.

| A real bank will not | The scam relies on you doing it anyway | | --- | --- | | Ask you to move money to a "safe" or "holding" account | The transfer is the theft | | Ask for your full PIN or full password | These unlock your account for the fraudster | | Ask you to read out a one-time passcode | The code authorises their payment, not your safety | | Send a courier to collect your card or cash | It hands over the physical means to spend | | Ask you to buy gift cards or withdraw cash for them | It converts your money into an untraceable form | | Pressure you to act instantly or keep it secret | Haste and secrecy stop you checking |

No genuine bank needs any of these to protect you, because a bank can freeze or secure your own account from its side without you moving a penny. The request itself is the tell. When you notice one, you no longer need to work out whether the caller is real — you already know.

The one rule that stops it

Every technique in this scam funnels towards the same weakness: it needs you to act on contact that came to you. Remove that, and it collapses. So the rule is simple and it is absolute — never act on an inbound call, text or email about your money. End the interaction and reach your bank yourself, on a number you trust.

In practice: if a "bank" call worries you, hang up. Do not use a number the caller gives you, and do not call back the number that rang — either could be part of the scam. Ideally wait a short while, or use a different phone, since a fraudster can sometimes stay on the line even after you think you have hung up. Then contact your bank on the number printed on the back of your card or in its official app. Many UK banks also take part in a free service that lets you dial 159 to be connected securely to your own bank's fraud line, a deliberately memorable number for exactly this moment. Whichever route you use, you are doing the one thing the scam cannot survive: swapping a stranger's chosen channel for one of your own, and putting the burden of proof back on them. It is the same discipline that defeats a phishing email — never resolve the message from inside the message — carried onto the phone, and covered further in how to spot a phishing email.

If money has already left your account, tell your bank immediately — speed genuinely affects whether a payment can be halted or recovered. Under rules now in force, victims of this kind of authorised push payment fraud may be entitled to reimbursement from their bank in many cases, so report it rather than assuming the loss is final, and our guide to getting your money back sets out the order to do things in. A scam text can be forwarded to 7726 to help your network block it, and a suspicious email handed to the National Cyber Security Centre at [email protected].

Before you go

Turn the whole scam on its head and it becomes almost easy to hold. A real bank spends its energy proving things to you; a fraudster spends theirs getting you to prove things to them — your passcode, your PIN, your willingness to move money now. So make them earn it. Treat every unexpected contact about your money as unproven until you have reached the bank on a number you chose, and let the caller's reaction to that decide it: the genuine will wait while you call back, the fraudulent will fight you for staying on the line, because the line is the only place their story works.

Repeat it to yourself until it is second nature: my bank will never ask me to move my money to keep it safe, and I will never settle a money question on a call that rang me. Hold those two lines and the most polished impersonator in the world runs out of moves. No tool can sit in on a live phone call and stop you mid-sentence, and the checker we are developing at CheckAScam makes no such claim — it is built to weigh the links and websites a scam later steers you towards, a narrower and more honest promise than the "instant scam detector" some apps advertise. The phone, in the end, is defended by a habit, not an app: hang up, and call back on a number that is yours.