How to check whether a call or text from your bank is real

How to check whether a call or text from your bank is real

"We're calling from your bank's fraud team. We've spotted a suspicious payment and need to confirm your identity." Or the text: "Your account has been suspended. Verify your details here." Bank impersonation is one of the most effective phone scams there is, not because the scammers are technical geniuses, but because they've perfected the script: urgency, authority and a solution that needs you to act now, without thinking.

The good news: you don't need to be able to tell a real call from a fake one on the spot. Nobody can, because the number on your screen can be faked and the scripts imitate real bank staff well. What you need is a method that works without you having to decide. Here it is.

The method: you hang up, you call back

It works for calls and texts alike, and it has three steps:

1. Do nothing within the call or message you've received. Don't give out details, tap links, press keys, install anything or read out codes you receive. If it's a call, say goodbye politely and hang up. Nothing bad happens if you hang up on your real bank: they'll call you again or you'll sort it out another way.
2. Open the official channel yourself. Call your bank on the number on the back of your card or on its official website (typed in by you), or open the bank's official app, installed from the app store. Never use the number that called you or the link they sent you.
3. Check there. If there really was a suspicious payment, a frozen account or something pending, it will show up in your transactions or a genuine member of staff will confirm it. If nothing shows up, the message was fake.

That's all there is to it. The trick is understanding why it works: you choose the channel, so it doesn't matter that the scammer faked the number or cloned the bank's website. Their deception lives inside the call or the text; the moment you step outside it, they're left with nothing.

The same method works for checking a message from HMRC or the DWP and a fake parcel text (both covered in our step-by-step guides), and for the fake DVLA vehicle-tax text. Learn it once and it works for everything.

What your real bank will never ask you for

Memorise this list, because it's the quick test whenever you're in doubt:

• Your PIN, your full password or your security codes. Your real bank may ask you to identify yourself in ITS app or on ITS website; it will never ask you to read out your passwords over the phone or by text.
• The one-time codes it sends you by text. Those codes authorise transactions. Anyone asking for them over the phone is trying to get you to approve a transaction THEY started. This is the central trap in almost every bank impersonation call.
• To install a remote-access app (AnyDesk, TeamViewer and the like) "so they can help you". No bank does that. It's the step before they empty your account in front of your eyes.
• To move your money to a "safe account", or to make a "test" transfer or one "to reverse the fraud". A transfer you make yourself goes out instantly and is very hard to undo. Your bank will never ask you to move money over the phone to protect it.
• To act without hanging up. "Don't hang up, it's urgent, if you hang up the payment will go through." Haste is the scammer's tool. Your real bank would rather you checked than obeyed quickly.

The most common variations and their scripts

• The payment you don't recognise. "There's a payment of £800 at an electronics shop. Do you recognise it?" You say no, and they guide you through "cancelling" it: install something, read out codes, make a transfer. Everything after that "no" is the scam.
• The frozen account, by text. A link to a website identical to your bank's, where you enter your username and password. From then on, they're in control.
• The fake member of staff who "protects" you. Friendly, professional, and already armed with your basic details (your name, your address, the last digits of your card: all of that circulates in data breaches). Professionalism proves nothing; only the channel does.
• The disguised approval. They ask you to approve something in your banking app, or read out a code, "to verify your identity" or "to cancel the payment", and it's actually a payment, or your card being added to their Apple Pay or Google Pay. Always read what you're approving in the app.

What to do if you've already given out details or codes

1. Call your bank immediately (on the number on the back of your card) and explain what happened. Ask them to block your cards, stop any pending transactions and reset your login details.
2. Check your transactions over the following days with app notifications turned on.
3. Report it to Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101, with screenshots and the caller's number, as the NCSC explains. You'll get a crime reference number your bank may ask for. Forward scam texts to 7726.
4. If you were tricked into sending money yourself, ask your bank about the reimbursement rules for authorised push payment (APP) fraud, under which banks have to refund many victims. If your bank turns you down, you can complain to the Financial Ombudsman Service. The FCA's scam guidance has more advice on financial scams.
5. Report the number in the spam numbers directory so it gets flagged.

Quick questions

Doesn't the number on the screen prove it's my bank? No. Caller ID can be faked (this is called spoofing), and scammers use it precisely with real bank numbers, so that looking the number up seems to confirm them. That's why the rule is never to decide within the call.

What if they already know my name, my address and my balance? Personal data circulates in data breaches, and a balance can be vaguely invented ("a significant payment"). Knowing things about you doesn't make them your bank. Apply the method anyway.

Can I ask them for something so I can check them myself? You can ask for the person's name and a reference number... and then hang up and call the bank yourself to check. Any "check" that happens without hanging up proves nothing.

Will my bank mind if I hang up on them? No. Hang up without guilt and call back on the official number. That's exactly what their fraud team wants you to do.

Keep the rule in one sentence: if your bank contacts you, do nothing there; hang up, open the official channel yourself and check. Share it with the people around you: it's the sentence that saves the most money.