How to check your bank is really contacting you

A call, text or email arrives saying it is from your bank. It may even warn you about fraud, which makes it feel more urgent and more believable. The safest response is the same in every case: do not give anything away on the spot, end the contact yourself, and get back in touch with your bank through a route you know is genuine, such as the number printed on your card or the 159 hotline¹. If you are worried about your account security, contact your bank directly using the number on your card or by calling 159¹.

Banks do make genuine fraud calls, and they do send genuine fraud texts, so you cannot assume every approach is fake. What you can rely on is a set of firm rules about what a real bank will never do. It will never ask for your PIN or your online banking password, never ask you to move money to a "safe account", and never ask you to confirm personal or financial details by text or through a link in a text². A caller who breaks any of those rules is a fraudster, whatever number appears on your screen.

Fraudsters can also stay on the line after you hang up, so that when you dial what you think is your bank's number, you are still speaking to the same scammer⁴. That is why the standard advice is to wait at least 15 minutes before calling back on the same phone, or better, use a different phone altogether⁵. This page explains how to check a contact safely, how genuine fraud alerts work, and what to do if you have already given something away.

Is this call really from my bank? How to check safely

The only reliable way to check a caller is genuine is to end the call and contact your bank yourself. If you receive a call claiming to be from your bank and you are unsure whether it is genuine, call 159². If your bank is signed up to the 159 service, calling that number will put you through to your bank's genuine customer service line¹⁰. You can also use the number printed on the back of your card or the contact details on your bank's own website or app.

Be careful with any number the caller gives you, or that appears in a text or email, because fraudsters copy banks' formats and can make a fake number show on your caller display. More than one spoofed mobile number has been reported calling people while impersonating well-known banks, claiming to be from the bank's fraud department and saying an account has been compromised, all to coax out personal and financial details¹¹. A display showing your bank's name is therefore not proof of anything.

Some banks offer ways to verify a caller during the call itself. If you are with Barclays, you can ask a caller claiming to be from the bank to send a secure notification to your Barclays app, which proves whether they are genuine¹². Nationwide offers a Call Checker that lets customers verify whether they are really on the phone with the bank⁴. These in-app checks are useful, but the general rule stands: if a caller pressures you, refuses to let you check, or tells you to lie to anyone, end the call. If someone asks you to lie to your bank, hang up, as this is a scam¹³.

Call 159 to reach your bank directly

159 is a dedicated banking scam line. If you think someone is calling to trick you into giving them money or your personal details, hang up and call 159⁸. The Bank of England's own guidance is the same: if you are unsure about a call from someone who claims to be from your own bank, hang up and dial 159 to reach your bank⁶. When you call, you will be put through to your bank's genuine customer service line⁷, and MoneyHelper describes it as connecting you to your bank's fraud department¹.

The service works because it is a single, memorable number that you dial yourself. You choose to make the call, so the person you reach is your bank, not whoever rang you. That breaks the fraudster's main advantage, which is being the one who initiated the contact and controls the conversation.

Two practical points are worth knowing. First, not every bank is signed up, so check whether yours takes part¹⁰. Second, calls to 159 are usually charged at the national rate, though it depends on your phone provider⁸. If you cannot use 159, the number on the back of your card or in your banking app does the same job. Age UK gives the same advice for anyone who notices unusual activity on their account: call the centralised number 159, or the phone number on the back of your bank card¹⁴. The dedicated page on calling 159 covers the service in more detail.

Hang up and wait 15 minutes, or use another phone

This is the step people most often get wrong, and it matters because of how landlines in particular behave. Research has found that scammers can keep the line open after you hang up, so that when you pick up the phone again and dial, they are still there listening in, or even answering as if they were your bank⁵. Independent Age describes exactly this trick in its scam scenarios: when you ended the call and dialled the number on the back of the card, the scammer stayed on the line, making you think you had rung the bank when you were actually still talking to the scammer³.

The advice across independent organisations is consistent. Use a different phone to call the company back on a trusted number, or wait for at least 10 to 15 minutes⁷. Business Debtline and National Debtline both say to wait at least 15 minutes before you call back, or use another phone if possible¹⁵. Which? gives the same figure when advising victims of bank transfer scams⁵, and the same wait is recommended after a suspicious survey call¹⁷ and when contacting your bank after a recovery scam call¹⁸.

Some sources go further. Independent Age suggests waiting at least 20 minutes before calling an organisation or company that has called you unexpectedly¹⁹. Official guidance for Northern Ireland also sets the wait at 20 minutes before calling your bank on a trusted phone number to check it out²⁰. The differences between sources are small and the direction is the same: the longer the wait, or the more genuinely separate the phone used, the greater the protection against a scammer who has kept the line open.

What your bank will never ask for in a call or text

These rules are absolute, and they come from banks, regulators and consumer bodies alike. Your bank will never ask you for your PIN or your online account password, and neither will any trustworthy online retailer²¹. Banks will not ask you for your account number or PIN when making a genuine fraud call³, and your bank will never ask you to disclose full security and password details, so alarm bells should ring if that happens²².

StepChange sets out the same list from the other direction: your bank will never ask you to tell them your online banking password, authorise a payment, move money into another "safe account", or carry out a "test transaction"²³. A request to move money is the clearest red flag of all, because no genuine bank needs you to transfer funds to protect them. If you are asked to do this, you are being targeted by a safe account scam.

The same rules apply to texts and emails. Banks will not ask you to confirm personal or financial information via a text, or via a link from a text³. Official guidance is blunt: you will never be asked for your bank details by text, social media, email or via links to click within a text or email²⁴. UK Finance, the banking industry body, states the same about itself: "We would never call or text anyone, especially not to request payments."²⁵

AIB (NI) puts the rule in terms that apply to every bank: it will never ask you to share passcodes, card reader codes, credit card details or personal or financial details after clicking a link or phoning a number in a text or email⁹. The same principle extends beyond banks. HM Courts and Tribunals Service states it will never telephone you to ask for your bank details or to make a bank transfer using your sort code and account number²⁶. Any caller or message asking for these things is not genuine, whoever they claim to be.

How genuine bank fraud alerts work: app, text and automated call

Banks really do contact customers about suspected fraud, and it helps to know what that looks like so you can tell it apart from an impersonation. Banking fraud can occur through three channels: internet banking, telephone banking and mobile phone banking in your app²⁷. Genuine alerts therefore arrive through those same channels: a notification in your banking app, an automated phone call, or a text message asking you to confirm a transaction.

A genuine fraud alert is normally narrow and specific. It points to a particular transaction or card payment and asks you to confirm whether it was you. It does not ask for your PIN, your password, a one-time passcode or any card details, and it does not ask you to move money. Take Five, the national anti-fraud campaign, advises people to set up bank alerts in their app so they know when their card has been used²⁸, and to turn on bank alerts and check accounts regularly, contacting the bank immediately about any spending you do not recognise²⁹.

The reason banks push customers toward app alerts is that the app is a channel only you and the bank can see. A fraudster can spoof a phone call or a text, but they cannot put a message inside your genuine banking app. That is also why app-based verification, covered in the next section, has become a trusted way to check a caller.

The distinction to hold on to is simple. A genuine alert gives you information and asks for a yes or no. A scam gives you a story and asks for details, codes or money. If a message does the second thing, it does not matter how well it is dressed up: treat it as a scam and report it.

Checking a caller in your app: Nationwide and Barclays

Two large banks now offer ways to verify a caller during the call, and they are worth knowing about because they turn the app into the judge of whether a call is real.

Nationwide's Call Checker allows its customers to verify whether they are on the phone with the bank during calls⁴. Rather than trying to decide whether a caller sounds convincing, or whether the number looks right, a member can use the Call Checker to confirm directly whether the person on the line is genuinely from Nationwide. If the check fails, or the caller resists being checked, the call is not genuine.

Barclays works the other way round: if you are with Barclays, you can ask callers claiming to be from the bank to send a secure notification to your Barclays app to make sure they are genuine¹². A real Barclays caller can do this; a fraudster cannot, because they have no access to the bank's systems. The request itself becomes a test, and there is no reason a genuine caller would object to it.

These tools are useful, but they are not a substitute for the basic habits. Not every bank offers an in-call check, and fraudsters will try to move the conversation along before you have time to use one. The warning signs of a scam still apply, and hanging up and calling back on 159 or the number on your card remains the universal check that works with every bank signed up to the service.

AIB (NI) fraud texts: reply 1 or 9 within eight hours

AIB (NI) operates a text alert scheme that shows what a genuine bank fraud text looks like in practice. To help prevent fraud, the bank sends a text message if it needs you to confirm a card transaction⁹. The text asks you to reply with "1" if the transaction was yours, or "9" if you do not recognise it⁹. For any reply other than 1 or 9, the bank may send another text asking the same question⁹.

There is a time limit attached. If you do not respond within eight hours of receiving the original text, the bank may send another message, and a hold may be placed on the card so that it cannot be used⁹. That is a fraud prevention measure, not a punishment, but it explains why an unanswered text can leave you with a card that suddenly stops working.

The texts come from specific numbers, which the bank publishes so customers can recognise them. From 28 September, debit card texts come from +44 7897 025515 for UK customers, with +353 86 180 3367 used where the customer has a Republic of Ireland address and mobile number. Personal credit card texts come from +44 7480 533591, and commercial credit card texts from +44 7700 174510 for UK numbers, with +353 86 180 0846 for Republic of Ireland numbers⁹.

AIB (NI) states that you cannot opt out of these alerts, and that no registration is needed: if the bank holds a mobile number for you, it may send you a text automatically whenever necessary⁹. Replying costs whatever your mobile operator charges for sending a normal text⁹. The bank also repeats the core rule: it will never ask you to share passcodes, card reader codes, or personal or financial details after clicking a link or phoning a number in a text or email⁹. A text that does any of those things is not from the bank, whatever number it appears to come from.

When a real alert blocks your card, and how to unblock it

Sometimes the fraud protection itself is what you notice first: a card stops working, or a payment is declined, because the bank has acted on a suspicion. The Financial Ombudsman Service handles complaints from people whose bank or building society has frozen their account or blocked a payment, and it lists the common reasons: unusual or suspicious activity on the current account, or doubts about whether the customer had authorised a payment or other activity³⁰.

If your card is blocked following a fraud alert, the way to resolve it is to contact the bank through a trusted route and confirm whether the flagged activity was yours. With the AIB (NI) scheme, that confirmation is built into the text itself: reply 1 to confirm a transaction, and the hold is lifted; fail to reply within eight hours and the hold may stay on the card⁹. In other cases a call to the bank, or a message through your app, does the same thing.

Two cautions apply. First, fraudsters exploit exactly this situation. The Financial Ombudsman Service has heard from people who were scammed by fraudsters who used a bank outage to trick them into sharing their bank details, for example pretending to call from the bank and offering to help³¹. A caller who says your card is blocked and offers to fix it is describing a real scenario, which is what makes the approach convincing. Second, if you see spending you do not recognise, contact your bank immediately²⁹, and follow the steps for an unrecognised transaction rather than assuming the bank has it in hand.

If the bank will not unblock the card or release a payment and you believe it is wrong, you can complain to the bank and then to the Financial Ombudsman Service, which looks at frozen accounts and blocked payments³⁰.

How to report a suspicious call, text or email

Reporting serves two purposes: it gets the message investigated, and it helps protect other people. The routes differ slightly across the UK, so it is worth knowing which applies to you.

In England, Wales and Northern Ireland, suspicious calls can be reported to Report Fraud on 0300 123 2040, or through its online fraud reporting tool³². Official guidance for Northern Ireland also asks people to report suspicious emails or text messages asking for bank details online to Report Fraud or by phone on 0300 123 2040, and to tell the local Jobs and Benefits office³³. UK Finance gives the same basic instruction for anyone who has been scammed: contact your bank immediately and report it to Action Fraud²⁵, and NS&I's security advice is the same, to contact your bank immediately if you think you have fallen for a scam and report it to Action Fraud³⁴.

Specific types of message have their own routes. Suspicious text messages claiming to be from HMRC can be forwarded to 60599, charged at your network rate³⁵. Fake delivery texts, one of the most common scams, aim to trick you into handing over personal information such as your name, phone number and address, and to steal banking details such as card numbers and which bank you use³⁶; if you have lost money after following a link in a fake text, contact your bank³⁶. You can also forward suspicious texts to 7726, as covered in the guide to forwarding suspicious texts to 7726, and the full reporting routes for each nation are on the reporting a scam page.

If you have already given details or money to a caller

Act quickly, but act safely. If you are worried you have given your payment details or money to a scammer, contact your bank or payment provider as soon as possible and explain what has happened³⁵. The Payment Systems Regulator's advice is the same: as soon as you realise you have fallen victim to a scam, immediately contact your bank to report it³⁷. If the scammer called you on the phone you are about to use, wait at least 15 minutes or use a different phone first⁵.

Use a trusted route to make that call: the number on the back of your card, your banking app, or 159. Do not use a number given to you by the caller¹³. The Payment Systems Regulator also advises people contacted out of the blue by someone claiming to be from a bank or a regulator to hang up and contact the organisation directly using publicly listed contact details, and not to be pressured into sending money³⁸.

If money has left your account, ask the bank about a refund. How bank transfer refunds work is covered in the guide to authorised push payment reimbursement, and the steps to take immediately are on the first steps for victims page. If the bank refuses, you can complain, and Which? provides a template letter asking the bank to credit the disputed sum back and confirm it has done so³⁹. A refused refund can be taken to the Financial Ombudsman Service.