The 'your account has been hacked' phone scam and what to do

A call comes in, the screen shows your bank's name, and the person on the line says your account has been hacked. They may already know your name, your address, even a security word. They tell you to move your money quickly to a "safe account" before it is taken. It is a scam, and the number on your screen is not evidence of anything: scammers can mimic an official telephone number to appear to be from a legitimate organisation such as a bank or utility company¹.

The safe account does not exist. It is an account the criminals control, and money sent to it is gone. Your bank will never phone you out of the blue, ask you for your PIN number or password, or ask you to transfer money into a different account². If a caller does any of those things, the call is not from your bank, whatever the display says.

If you have already given details away, contact your bank or payment provider as soon as possible and explain what has happened³. Then contact the police on 101 and report the scam to Report Fraud, and keep records of all contact and correspondence between you and the scammer⁴.

How the "your account has been hacked" call works

The script is short and it is built on panic. A caller posing as your bank says your account has been compromised and asks you to transfer funds to a "safe account"⁸. The tactics are consistent across the reports: saying your account has been hacked or that you have not paid a bill, spoofing telephone numbers, running through security questions, and asking you to transfer money quickly or move money to a "safe account"⁹.

The reason it works is that the caller sounds prepared. Details leak from data breaches and are traded between criminals, so a caller knowing your name, address or a security word does not make them genuine. In one reported case a scammer knew the customer's full name, address, email address, phone number and security word, and paid a penny into his account to make the story convincing¹⁰. Another reported call knew the recipient's name and birthday⁷.

The same script is used for other bills. A caller claims to be from HMRC saying there is an issue with your tax refund or an unpaid tax bill, and may leave a message asking you to call back¹. A postcard from a fake delivery company claims a parcel is waiting and asks you to call a number, where you are asked to pay a sum of money by credit card for a package that does not exist¹¹. Real bailiffs will never ask for your bank details over the phone or ask you to make a bank transfer using your sort code and account number¹².

What the criminals want is either a payment or access. Stolen information is used to contact you and gain your trust, then convince you to make a payment or provide access to your accounts, to set up accounts or take out loans in your name, or to access your accounts directly to steal money¹³.

Spoofed numbers: a familiar caller ID proves nothing

Number spoofing is the deliberate falsification of caller ID information to disguise the true origin of a call¹⁴. It is why the display on your phone cannot be trusted. Scammers often use number spoofing, where the caller ID appears genuine, to make the call seem more trustworthy³. The name or number displayed on your phone can be faked by criminals, which is called spoofing¹⁵.

The technique is used across every channel. Scammers can change their caller ID to make it look like a bank is calling¹⁶, and they use a phone number that looks familiar, disguising their actual phone number with a number which may look like one from a company you know¹⁷. The same identity masking technology changes the name displayed as the sender of a text message, so a message can appear in the same thread as genuine ones from your bank¹⁸. Scammers sometimes use number spoofing to make your phone display "HMRC" as the sender, instead of a phone number¹⁹.

The practical rule is to treat the display as a label the caller chose. Do not trust caller ID, because scammers can mimic the numbers you know²⁰. If you want to check whether a call was genuine, ring the organisation back on a number you already hold: the number on the back of your card, your banking app, or 159¹⁵. Do not use a number the caller gave you¹⁵.

Security questions are part of the script

A genuine bank may ask you to confirm some details when it calls about suspected fraud, but there are lines it does not cross. Banks will not ask you for your account number or PIN when making this type of call²¹. Your bank will never phone you out of the blue, ask you for your PIN number or password, or ask you to transfer money into a different account².

The scam version runs the other way round. The caller asks you to prove who you are, then uses what you say. Some calls go further and ask you to install software: the person may say your device has a virus and that you need to download software to fix it, which is spyware¹. Others use a recorded message or a voicemail to get you to ring back, including voicemails claiming to be from a company's human resources team about a job opportunity²².

Two things are worth knowing about the numbers involved. A number used in a scam may have been linked to other scam calls before, so a search can turn up a pattern²³. And a number that looks like your bank's may belong to an innocent person whose line has been spoofed, so replying to a fake message or calling the number back only confirms your number is in use and may bring more scam messages and calls¹⁰.

What to do during the call and straight after

The single most useful action is to end the call and start a new one on a route you control. If you receive a call from someone claiming to be from a trusted organisation, hang up and call them back on a number you know to be correct²⁴. Contact your bank using a trusted route, such as the number on the back of your card, your banking app or 159, and do not use a number given to you by the caller¹⁵.

There is a catch if you ring back on the same handset. If you hang up on a dodgy call, use a different phone to call the company back on a trusted number, or wait for at least 10 to 15 minutes⁶. Research has found that scammers can keep the line open to listen in to your call, so use a different phone line or wait at least 15 minutes before you contact your bank²⁵. If you contact your bank immediately after a scam call, wait at least 15 minutes before calling your bank using the same phone, or use a different phone²⁶.

If money or account details have gone, the order is: bank first, then police. Contact your bank or payment services provider immediately, contact the police on 101, report the scam to Report Fraud, and keep records of all contact and correspondence between you and the scammer⁴. Call your bank immediately using the number on the back of your bank card and report it to Report Fraud, formerly known as Action Fraud²⁷. Contact your bank immediately if money or account details are involved, and report it to the police at reportfraud.police.uk or by calling 0300 123 2040²⁸.

If your phone itself has gone, tell your network provider, which stops criminals being able to use your number and impersonate you²⁹.

If you have already given details away

Speed matters more than anything else. Contact your bank or payment provider as soon as possible and explain what has happened³. As soon as you realise you have fallen victim to a scam, contact your bank to report it³⁰. If your identity has been stolen, contact your bank, credit card company and the local police on the non-emergency phone number, 101, as soon as possible³¹.

Keep everything. Records of the calls, the numbers, the messages and any correspondence are what a bank or an investigator will work from⁴. If you sent a payment, tell your bank it was a scam so they can try to recall it; if you gave card details, they can block the card.

Be careful about who offers to help next. A recovery scam targets people who have already lost money, promising to get it back for a fee. If a firm contacts you out of the blue offering to recover funds, treat it with the same suspicion as the original call.

If your bank will not refund you, there is a route. The Financial Ombudsman Service looks at complaints about fraud and scams involving unauthorised payments and identity theft⁴, and about IT problems at banks³². The Payment Systems Regulator sets out what to do if you have fallen victim to a scam³⁰. Free, impartial help is available from MoneyHelper³, and debt advice charities can help if a scam has left you struggling with bills³³.

Where the protection stops

The rules protect you most clearly when a payment was not authorised by you. When you are tricked into authorising a payment yourself, the position is harder, and banks look at what the customer did as well as what the bank did. That is why the advice to hang up and ring back on a trusted number matters: it is the step that keeps a scam call from becoming an authorised payment.

There are limits on what any bank can recover. Money sent to a criminal's account is often moved on within minutes. Reporting quickly gives the bank the best chance, but it is not a guarantee.

Two habits reduce the risk. Question uninvited approaches and contact companies directly using a known email or phone number³⁴. And if you are unsure about a call from someone who claims to be from your own bank, hang up and dial 159 to reach your bank safely³⁵. If your bank is signed up to the 159 service, that call goes through to its genuine customer service line³⁶.