How do I check a call or email really is from the organisation it claims?

Almost every impersonation scam survives or dies on one moment: how the person verifies. Done inside the channel the criminal controls — replying, ringing back, clicking through — verification confirms the fraud instead of exposing it. Done outside it, no impersonation survives, whatever the story was.

Safety

Step by step

1. Break contact completely.End the call, close the message, do not reply. You do not owe an explanation and there is nothing to lose. Anyone genuine will be perfectly happy to be rung back.
2. Find a route you already had.The number on the back of your bank card. A number on a bill, a statement or a letter that arrived by post. The organisation's official app that you installed yourself. The website address typed into the browser by hand.
3. Do not use search results as a source of phone numbers.Fake support numbers are placed in paid adverts and in manipulated listings for banks, airlines, energy suppliers and computer companies. If you must search, go to the organisation's own website first and take the number from there.
4. Wait, or use a different phone, before ringing back.A caller can hold a landline open so that your outgoing call reaches them. Several minutes, or a mobile, removes the problem.
5. For a bank, use 159.It connects to your own bank's fraud line and cannot be redirected. Not every bank and network participates, so the number on your card is the fallback.
6. Verify a person at the door the same way.Do not judge by a uniform or an ID card. Keep the door closed, ring the organisation's published number, and ask them to confirm. Utilities operate a password scheme you can register for in advance.
7. Verify an email by going to the account, not the link.If it says there is a problem with an order, a payment or a delivery, open the app or type the site address and look at the account. Anything real will be visible there.
8. Say what happened when you get through.Tell them exactly what you were contacted about. Organisations track impersonation of themselves, and it is often how they discover a new campaign.

Tips

• Keep a short list of the numbers you would need under pressure — bank, energy supplier, GP, school — saved in your phone by name, so the right number is already there when you are rattled.
• "You can ring us back on this number to check" is not reassurance. Genuine organisations expect you to use your own route, and criminals suggest theirs.
• Being asked to stay on the line while you check something is a warning by itself. Verification requires the call to end.

Common mistakes

• Verifying a text by replying to it — Both ends of the conversation are controlled by the sender. A confident reply confirming legitimacy is part of the script.
• Trusting a sender name or a caller ID — Both are set by whoever sends the message or places the call, and a spoofed text threads into the same conversation as genuine ones.
• Ringing the number on a letter that arrived out of the blue — Postal impersonation exists too. For anything asking for money or details, use a number you already held.

Questions people ask