Scam call pretending to be your bank: what to do in the UK

A phone rings and the caller says they are from your bank, or from the police. They sound serious, and they want something from you quickly. This article sets out what two UK sources say to do: the National Cyber Security Centre (NCSC) and Citizens Advice.

A note on scope. The NCSC describes phone scammers who pretend to be from an organisation you trust, "such as your bank or the police". Neither page we used is a dedicated guide to bank impersonation fraud, so we do not describe how any particular bank handles these cases. What follows is the general advice both bodies give on suspicious calls and messages, and on reporting scams.

How these calls work

The NCSC says phone scammers call you unsolicited and pretend to be from an organisation you trust. It gives your bank and the police as examples. The calls may be automated, or from a real person.

They may ask you for personal information, like banking details, or tell you that you need to transfer money. If a call fits that pattern, treat it as suspicious, whatever name the caller gives.

First: protect yourself from further risk

Citizens Advice says to take steps to protect yourself from things getting worse before you report a scam. It points to its separate advice on what to do if you have been scammed, which we have not read for this article.

Citizens Advice also says when to call the police. Contact the police immediately by calling 101 if:

• the scammer is in your area; or
• you have transferred money to the scammer in the last 24 hours.

If you feel threatened or unsafe, call 999.

Write down the details

Citizens Advice suggests writing down the details of the scam, because it helps you remember the important information when you report it. Include:

• who you have been in contact with: names, numbers and addresses if you have them;
• why you are suspicious;
• what information you have shared, for example passwords, PINs or bank details;
• whether you have paid any money; and
• how you paid, for example credit card or bank transfer.

Report a suspicious phone call

The NCSC says that if you have lost money or have been hacked as a result of responding to a phishing message, you should report it:

• In England, Wales or Northern Ireland, visit reportfraud.police.uk or call 0300 123 2040.
• In Scotland, report to Police Scotland by calling 101.

Citizens Advice says you should report all types of scams to Report Fraud, the UK's national reporting centre for fraud. It adds that Report Fraud can get the National Fraud Intelligence Bureau to investigate, and that it will give you a crime reference number. Citizens Advice notes this can be helpful if you need to tell your bank you have been scammed. It says reporting online is quickest.

You can also report a scam to Citizens Advice, using its online form or its consumer helpline. Citizens Advice says it passes reports to Trading Standards and does not investigate scams itself. Trading Standards decides whether to investigate, and might contact you for more information.

If the contact was a text, an email or a letter

Citizens Advice gives route-specific advice for other kinds of scam contact:

• Scam text message. Forward it to 7726. It goes to your phone provider.
• Scam email. Forward it to report@phishing.gov.uk. It goes to the NCSC, which might be able to stop other people being scammed.
• Scam letter. Royal Mail investigates postal scams, and you can report on its website.
• A scammer imitating a company or person. Contact the real company or person to let them know their name is being falsely used. Citizens Advice mentions a common imitation scam involving emails, texts or calls that seem to be from HM Revenue and Customs (HMRC).
• A scam involving financial services. If it involves cryptocurrency, investments, insurance or pensions, report it to the Financial Conduct Authority.

If you shared personal information

The NCSC points to separate advice on how to protect yourself if you think you have shared personal information with a suspicious caller. We have not read that page, so we do not summarise it here. If you also visited a website you think is suspicious, the NCSC says you can report a scam website or link to it.

Protect yourself from scam calls in future

The NCSC says many phone companies offer services that can protect you from scammers and other nuisance callers, including caller display, incoming call blocking and anonymous call rejection. Contact your phone provider for more information. The NCSC also links to guidance on blocking numbers and messages on Android, Apple, Signal and WhatsApp.

It also gives a reason to think about what you share online. Criminals use information about you that is available online, including on social media sites, to make their phishing messages more convincing. The NCSC says you can reduce the likelihood of being phished by thinking about what personal information you and others post about you, and by reviewing your privacy settings within your social media accounts.

Where Remove Me fits in

Remove Me offers a free scan with no account needed. You enter your details and the service searches publicly visible web results, known public data breaches (Have I Been Pwned) and a register of data brokers, then shows a report. The report is unlocked with a 6-digit code sent by email. Remove Me does not yet send erasure requests on your behalf.

What the sources do not say

Neither source gives a script for what to say to a caller, tells you how to confirm whether a call really came from your bank, or explains how to get money back. Citizens Advice mentions separate advice on trying to get your money back after a scam, which is outside what we have read here.