How to Spot Bank Impersonation Scams in the UK
Bank impersonation scams work by making a fraudulent contact look authoritative. The safest response is to break the contact, verify the organisation independently and refuse to move money or disclose security information because an incoming caller demands it.
Caller ID and message branding can be spoofed
The FCA warns that scammers can manipulate caller ID so a real bank or FCA number appears on the screen. A familiar number is therefore not proof that the person calling is genuine.
Treat the content of the request as more important than the display. If the caller asks for passwords, full security credentials or a transfer, end the contact and use the bank's official app, card number or published website to reconnect.
Do not call back using a number supplied in the suspicious message. Independent verification means obtaining the contact route separately.
For 'Caller ID and message branding can be spoofed', apply the rule to the exact amount, date, provider and payment or account type involved. The page-specific control is that identity should be verified through an independently obtained contact route rather than caller ID, urgency or convincing personal information. Save the live source or provider wording used for section 1, because a small change in timing, eligibility, fee, account status or support route can change the practical result without changing the broad banking label.
Use a caller whose displayed number matches the bank but who pressures the customer to transfer money. The failure case shows why caller ID must be ignored in favour of independent verification.
Urgency and secrecy are common warning signs
Fraudsters often say the account is under attack and action must happen immediately. They can tell the victim not to speak to branch staff, family members or the bank's real fraud team.
A genuine security process should tolerate independent verification. If the caller tries to stop you from hanging up, checking another source or discussing the request, treat that as a major warning sign.
Pause before opening the banking app. The purpose of the urgency is often to prevent the victim from noticing inconsistencies.
For 'Urgency and secrecy are common warning signs', apply the rule to the exact amount, date, provider and payment or account type involved. The page-specific control is that identity should be verified through an independently obtained contact route rather than caller ID, urgency or convincing personal information. Save the live source or provider wording used for section 2, because a small change in timing, eligibility, fee, account status or support route can change the practical result without changing the broad banking label.
Use a caller whose displayed number matches the bank but who pressures the customer to transfer money. The failure case shows why caller ID must be ignored in favour of independent verification.
A genuine bank will not require a secret safe-account transfer
Impersonation scams commonly instruct customers to move money to a 'safe account'. FCA guidance warns about callers pretending to be banks or public bodies in order to obtain account information or payments.
Do not transfer money because an unsolicited caller says another account is safer. End the call and contact the bank independently. The real bank can investigate or protect the existing account without requiring a secret payment to an account chosen by the caller.
If the caller tells you to ignore Confirmation of Payee warnings or misstate the purpose of the transfer, stop immediately.
For 'A genuine bank will not require a secret safe-account transfer', apply the rule to the exact amount, date, provider and payment or account type involved. The page-specific control is that identity should be verified through an independently obtained contact route rather than caller ID, urgency or convincing personal information. Save the live source or provider wording used for section 3, because a small change in timing, eligibility, fee, account status or support route can change the practical result without changing the broad banking label.
Use a caller whose displayed number matches the bank but who pressures the customer to transfer money. The failure case shows why caller ID must be ignored in favour of independent verification.
Verification should start from a trusted source
Use the phone number printed on the card, shown inside the official app or published on the bank's website. For an FCA-regulated firm, the FCA Firm Checker can help confirm genuine contact information.
Wait until the suspicious call has clearly ended before making the new contact. Where practical, use a different device or channel if you are concerned the original call may still be active.
Ask the genuine organisation whether the contact was real before taking any further action. A legitimate bank will understand why an unexpected fraud call is being verified.
For 'Verification should start from a trusted source', apply the rule to the exact amount, date, provider and payment or account type involved. The page-specific control is that identity should be verified through an independently obtained contact route rather than caller ID, urgency or convincing personal information. Save the live source or provider wording used for section 4, because a small change in timing, eligibility, fee, account status or support route can change the practical result without changing the broad banking label.
Use a caller whose displayed number matches the bank but who pressures the customer to transfer money. The failure case shows why caller ID must be ignored in favour of independent verification.
Report any exposed information even if no money moved
If passwords, card details, security codes or personal information were disclosed, tell the bank promptly even when the victim stopped before making a transfer.
Change credentials through official channels where the bank recommends it and monitor the account for unusual activity. Keep screenshots, caller numbers, messages and timestamps for the investigation.
Early reporting can allow the provider to block cards, reset access or add additional monitoring before compromised information is used.
For 'Report any exposed information even if no money moved', apply the rule to the exact amount, date, provider and payment or account type involved. The page-specific control is that identity should be verified through an independently obtained contact route rather than caller ID, urgency or convincing personal information. Save the live source or provider wording used for section 5, because a small change in timing, eligibility, fee, account status or support route can change the practical result without changing the broad banking label.
Use a caller whose displayed number matches the bank but who pressures the customer to transfer money. The failure case shows why caller ID must be ignored in favour of independent verification.
BankOfferScout editorial view
For How to Spot Bank Impersonation Scams, BankOfferScout treats the safest route to verify a request before money moves as the anchor. We compare the outcome around cost, process, eligibility and the practical consequences for the reader’s money, because the largest headline figure is not automatically the feature that matters most in everyday use.
The editorial test for How to Spot Bank Impersonation Scams is whether the choice still works under normal behaviour. Our second test is resilience: would the choice still make sense after allowing for acting quickly on a message before independently checking the destination? That question often exposes the difference between an attractive headline and durable value.
Our editorial view on How to Spot Bank Impersonation Scams starts with practical fit rather than headline appeal. The last step is freshness. Confirm authentication steps, warnings, recovery routes and official reporting on the relevant provider page and the latest formal terms for the product or process; where a scheme, tax or regulatory rule matters, use the relevant regulator, scheme operator or official guidance as well. The final application, transfer or switch should always use current information.
Sources and related guides
Impersonation-scam guidance was checked on 30 September 2026 against live BankOfferScout and FCA material. Future updates should preserve the core control: end unexpected contact, verify independently and never treat caller ID or branding as proof of identity.
For 'Sources and related guides', apply the rule to the exact amount, date, provider and payment or account type involved. The page-specific control is that identity should be verified through an independently obtained contact route rather than caller ID, urgency or convincing personal information. Save the live source or provider wording used for section 6, because a small change in timing, eligibility, fee, account status or support route can change the practical result without changing the broad banking label.
Use a caller whose displayed number matches the bank but who pressures the customer to transfer money. The failure case shows why caller ID must be ignored in favour of independent verification.
- BankOfferScout - Spot Bank Impersonation Scams
- FCA - banking and online account scams
- FCA - protect yourself from scams
Related Guides: