Online banking safely: how your bank contacts you, what it never asks, and what to do if you've paid a scammer

Most people who avoid online banking are not worried about the app. They are worried about the phone call — suspicious activity, money must be moved now, the person on the line is from the fraud team. This call follows a script, and once you know the script it stops working on you.

This is general information, not financial advice. Your own bank’s fraud pages have the specifics for your account.

How banks actually contact you

A bank may text, email, ring, or message you inside its app. What matters is not the channel but what happens next. The UK’s Financial Conduct Authority (FCA) makes the point that does most of the work: “A genuine bank or business won’t mind waiting if you want time to think.”

So the rule is simple. Whatever arrives, you do not act on it directly. You end the conversation and contact the bank yourself, using the number on the back of your card or the app you already have. If the contact was genuine, the bank will know all about it when you ring.

In the UK there is a shortcut. Dial 159 and you are put through to your bank. Stop Scams UK, which runs it, calls it “an easy route back to safety when you get an unexpected phone call about a financial matter” and says that “unlike many long-form numbers, 159 cannot be spoofed or impersonated.” Barclays, HSBC, Lloyds, Nationwide, NatWest, Santander, TSB, Monzo and Starling are among the banks covered.

What a real bank never asks

The FCA is blunt about its own behaviour: “We’d never ask you to transfer money to us and we’d never ask for your bank account PINs and passwords.” Apply that standard to anyone claiming to be your bank, the police or the tax office. The US Federal Trade Commission (FTC): “Don’t give your personal or financial information in response to a request that you didn’t expect.” A request to move money somewhere “safe”, read out a code just texted to you, install something on your computer, or keep the call from your family is a request to refuse.

The FCA’s warning signs are worth keeping by the phone: “Is it unexpected?”, “Do you feel pressured to act quickly?”, “Are they speaking with authority?”, “Are you feeling worried or excited?”

The FTC’s four signs: scammers “PRETEND to be from an organization you know”, “say there’s a PROBLEM or a PRIZE”, “PRESSURE you to act immediately”, and “tell you to PAY in a specific way.” Its advice: “Stop and talk to someone you trust.” The Consumer Financial Protection Bureau notes that “scammers are pretending to be the CFPB” — which tells you how little a caller’s job title is worth.

Confirm Payee: the UK’s name check

UK banks run Confirmation of Payee. Pay.UK, which operates it, calls it “an account name checking service designed to help reduce misdirected payments.” When you set up a new payee, or change an existing one, the bank checks whether the name you typed matches the receiving account.

You get one of four answers: a match; a “close match”, which shows “the actual name of the account holder to check”; a “no match”, where Pay.UK’s advice is to “contact the person or organisation they are trying to pay” before sending anything; or “unavailable”.

Scammers know about this check, so expect to be told to ignore a no-match. Treat a no-match as a full stop, and “just click through” as the end of the conversation.

If you have already paid

Speed matters more than embarrassment.

UK. The Financial Ombudsman says “Contact your bank or payment services provider immediately.” Since 7 October 2024, banks must reimburse most victims of bank-transfer scams made by Faster Payments or CHAPS “up to a maximum of £85,000”, provided you tell the bank “no more than 13 months after the last payment you made.” The bank “may deduct an excess of up to £100 for each scam claim” and can refuse if you showed “gross negligence”. If it refuses or stalls, complain in writing, then go to the Financial Ombudsman.

Then report it. In England, Wales or Northern Ireland, contact Report Fraud (which replaced Action Fraud in December 2025) at reportfraud.police.uk or on 0300 123 2040; in Scotland, report it to Police Scotland on 101. Scam texts go to 7726 — “it’s free” — and scam emails to report@phishing.gov.uk.

US. The FTC gives instructions by payment method. Debit card: “Report it to your bank or credit union immediately… Ask them to refund your money.” Bank transfer or Zelle: “Ask them to reverse the payment and refund your money.” Wire transfer: “Report it to the wire transfer company immediately.” Gift card: “Contact the gift card issuer immediately.” If you gave away personal information, “go to IdentityTheft.gov”. Then “report a scammer to the FTC at ReportFraud.ftc.gov.”

And if someone later rings offering to recover your money for a fee, run the FCA’s checklist again. It is the same script in a different hat.

Bringing it together

Hang up and ring back on a number you found yourself. Never move money, share a code or install software because a caller told you to. Read the payee name check before you confirm. If money has gone, ring the bank first and report second. Scams depend on speed and secrecy, and you are now giving them neither.

Start with Tech confidence after 50: the complete guide, and for catching the message before it reaches your account, How to spot a scam text, email or call. If you want all of this as a printable checklist for beside the phone, our Tech Confident scam-proof guide is that checklist.

This week

• Bank’s real number on a note by the phone; 159 saved in your mobile if you are in the UK.
• Tell someone you trust that you will never move money on the strength of a phone call, so they can remind you.
• Forward one old scam text to 7726 (UK) or report it at ReportFraud.ftc.gov (US), to see how easy it is.

Corrected 7 October 2026: the UK’s fraud reporting service is now Report Fraud, which replaced Action Fraud in December 2025.