Numbers can be spoofed
The number displayed on your phone can be changed to resemble a bank or another trusted organisation.
Protection, evidence and public rules
How can I check whether a caller is really from my bank?
Caller ID, a familiar number and accurate account information do not prove who is speaking. A criminal may spoof the number or use information gathered from another source to imitate a bank’s security process.
Page P-006Guidance pageReviewed 29 August 2026
Key Guidance
End the call. Contact your bank through its official app, the number on the back of your card, a trusted statement or—where your bank supports it—159. Do not call a number supplied by the caller.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
Bank impersonation works because fraud and security calls are plausible. The caller may know real details, warn about a transaction and appear to help, while steering every check through the same conversation.
Known information is not proof
Names, balances, transactions or partial card details may come from exposed data, prior phishing or information you disclose during the call.
Security language creates authority
Case numbers, fraud teams, transfers and verification codes can imitate a genuine response process.
The caller controls the pace
Urgency and continuous conversation can stop you from consulting another person or choosing an independent route.
Consequences and movement
What may happen next
A caller may begin with a warning and progressively turn assistance into disclosure, approval, remote access or payment.
Security-code capture
The caller asks for a one-time code or approval while describing it as cancellation or verification.
Remote access
You are instructed to install software or share your screen so the caller can supposedly secure the account.
A transfer to safety
The caller claims money must be moved to protect it, creating an authorised push-payment loss.
A second false department
The call is transferred to a supposed investigator, police officer or senior bank employee who reinforces the story.
Practical response
What you should do
A genuine banking concern can be checked after you end the call. The independent route—not the caller’s patience or knowledge—provides the evidence.
- Hang upDo not remain connected while searching, checking an app or calling another number.
- Use a trusted banking routeOpen the official app or use the number on your card or statement. If supported by your bank, 159 can provide another route.
- Describe the exact claimAsk whether the transaction, case, employee and requested action exist on the bank’s genuine systems.
- Never disclose full security credentialsDo not share passwords, PINs or one-time codes, or approve an action you did not start and understand.
- Reject remote access and transfersDo not install software, share a screen or move money in response to an unsolicited security call.
- Act quickly if you compliedContact the bank at once through a trusted route, explain every action and ask it to secure accounts and attempt recovery.
Look more closely
A genuine bank caller will allow independent verification
Concern about an account can make staying on the call feel safer than ending it. A trustworthy process allows you to stop, use a number or app you already trust and confirm the issue without the caller controlling the check.
An unexpected security or fraud call demands attention.
Fear that money is moving creates urgency and reliance on the caller.
Spoofed caller ID, account details and procedural language imitate the bank.
Codes, transfers, downloads and callbacks remain controlled by the caller.
Ending the call and selecting a trusted bank route breaks that control.
Selected history
Historical cases and lasting lessons
Bank-number spoofing
Fraud calls may display a bank-like number even though the call originated elsewhere.
Lasting lesson: Caller ID is routing information, not proof of identity.
Authorised transfer impersonation
Callers impersonating financial institutions have persuaded customers to authorise payments under a false security story.
Lasting lesson: A payment authorised under deception is still a fraud event that should be reported to the bank at once.
Transferable understanding
Patterns over time
Knowledge is used as authentication
The caller supplies real details so later instructions feel equally reliable.
Help becomes action
A warning gradually changes into requests for codes, access or movement of money.
Transfers imitate escalation
A second voice or department can appear independent while remaining inside the same operation.
Independent contact is the decisive test
The bank’s official app or known number reconnects the claim to the genuine account.
Plain-language answers
Common questions
What if the number matches the bank’s real number?
Caller ID can be spoofed. End the call and contact the bank through a route you selected yourself.
Can a bank call about suspicious activity?
Yes. That possibility does not authenticate a particular caller or justify sharing sign-in details, installing software or moving money.
Should I wait before calling the bank back?
Use a different trusted route at once. If using a landline and concerned about line control, use the official app or another phone.
What if I approved a payment or shared a code?
Tell the bank at once what the caller said and exactly what you approved or disclosed. Preserve the call details for reporting.
Contact the bank first when money or access is at risk
Use the official app or a trusted number, not the caller’s route. Then report the impersonation and preserve the number, time, payment details and any messages.
Scamology Insights
Recognise when security becomes the scam story
These learning resources can help tell the difference between a genuine account concern and a caller-controlled process that uses fear, authority and urgency to redirect action. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency