How do I tell a real message from my bank?

Bank impersonation works because it arrives with urgency and apparent authority. The defence is a small number of absolute rules that hold regardless of how convincing the call is.

Safety

Step by step

1. Learn the three absolutes.A genuine bank will never ask you to move money to a new or 'safe' account, never ask you to read out a passcode or PIN, and never ask you to install remote-access software. Any one of these ends the conversation.
2. Ignore the number that is displayed.Caller ID is trivially spoofed, including to show your bank's real number. A text can also drop into the same thread as genuine bank messages. Neither proves anything.
3. Hang up and ring back properly.The number on the back of your card or in the app — never a number the caller gives you. Wait five minutes or use a different phone, because a caller can hold the line open on a landline.
4. Use the app rather than a link.If there is genuinely a problem it will be visible when you log in yourself. Never follow a link in a message to log in, however plausible the address looks.
5. Recognise the pressure pattern.Urgency, secrecy, and a reason not to hang up or speak to anyone. Genuine banks are content for you to ring back. Anyone discouraging that is telling you what they are.
6. Be sceptical of partial information.Scammers often know your name, address, and some transaction detail from a data breach. Knowing things about you is not evidence of legitimacy.
7. Treat passcode requests as definitive.One-time codes exist to authorise a transaction. Reading one out is authorising whatever the scammer is doing at that moment. No legitimate process needs it.
8. Refuse remote access absolutely.Any request to install software so someone can 'check' your computer or 'refund' you. That is a scam every time, including when it appears to come from a bank, a broadband provider or a tech company.
9. Check message details, carefully.Slightly wrong domain, generic greeting, small grammatical errors, a link that does not match the displayed text. Useful signals, though good scams have none of them.
10. Slow it down deliberately.'I'll call you back on the number on my card.' Said calmly, that single sentence defeats essentially all of these. You are allowed to hang up on anyone.
11. Act fast if you have already engaged.Ring your bank straight away on the card number, freeze the account in the app, change passwords from a different device, and report to Action Fraud. Speed materially affects recovery.
12. Know your reimbursement position.Victims of authorised push payment fraud have protections under the mandatory reimbursement rules. Report promptly and in writing, and escalate to the Financial Ombudsman if the bank refuses.
13. Talk about it with relatives.Agreeing in advance that nobody in the family ever moves money because of a phone call removes the isolation these scams depend on.

Tips

• 'Safe account' is the single clearest tell. No bank has ever asked anyone to do that, in any genuine case.
• Hang up, wait five minutes, ring the number on your card. That sequence defeats nearly all of it.
• Knowing your name and last transaction proves nothing — that data is bought and sold.

Common mistakes

• Trusting the number that appears on the screen — Caller ID and SMS sender names are trivially spoofed, including into the same message thread as genuine bank texts. They are not evidence of anything.
• Reading out a one-time passcode — The code authorises a transaction at that moment. Saying it aloud completes whatever the scammer is doing. No genuine process ever requires it.

If it doesn't work

Questions people ask