The Callback Rule: Verifying a Bank Call, Text or Email Without Panic

Fraudsters rarely arrive through the front gate. They prefer a plausible phone call, a text that looks as though it came from your bank, or an email with a familiar logo. The aim is not usually to pick a lock. It is to persuade you to open it yourself. In 2026, bank impersonation and authorised push payment fraud, often called APP fraud, remain among the most common ways for money to leave a UK account. The defence is less about spotting every trick than about following a short, repeatable routine before you act.

Why a routine matters more than fear

Panic is the fraudster’s ally. A caller who says a payment is about to leave your account, or a text that warns your card has been used abroad, is designed to make the next few minutes feel urgent. Urgency is the point. It stops you from doing the obvious thing: checking independently.

A routine gives you time. It also gives you something to say. You do not need to argue with a caller or try to outsmart them. You can end the call, verify through a channel you trust, and then decide what to do. That is calmer, safer and much harder to manipulate.

The callback rule

If someone contacts you claiming to be from your bank, do not use the phone number, link or reply address in the message. End the call. Close the email. Put the text to one side.

Then wait a few minutes. Fraudsters can keep a phone line open after you hang up, so a second call to a number you dial yourself may still reach them if the line has not cleared. Use a different phone if you have one, or wait before calling.

Find your bank’s official number from a source you already hold: the back of your debit or credit card, a recent paper statement, your banking app, or the bank’s website typed manually into your browser. Call that number and explain what happened. If you are unsure, call 159. The 159 service, run by Stop Scams UK, connects you to your bank’s fraud team and is a safe starting point for many UK banks. It is not a substitute for your own checks, but it can help you avoid a number supplied by a stranger.

For texts and emails, the same rule applies. Do not click the link. Open your banking app separately, or type the bank’s address into your browser, and check whether there is a genuine message waiting for you.

What a genuine bank will never ask for

A real bank may need to verify some information before it discusses your account. It may ask you to confirm selected characters from a password, approve a login in its app, or answer security questions. But there is a line it should not cross.

A genuine bank will not ask for your full PIN, your full password, or the whole of a one-time passcode. It will not ask you to move money to a so-called safe account. It will not ask you to install remote-access software so that someone can take control of your device. It will not ask you to hand cash or cards to a courier, buy gift cards, or keep the call secret from your family.

It will also not ask you to read out the full long card number and security code in response to an unsolicited call. If a caller creates a sense of secrecy, says you must not tell anyone, or tells you the branch staff are involved in the fraud, treat that as a warning sign rather than a reason to comply.

Texts, emails and links

Sender names can be spoofed. A text can appear in the same thread as genuine bank messages. A website address can look almost right at a glance. This is why independent verification matters more than the appearance of the message.

If you receive a suspicious text, you can forward it to 7726, the free reporting service used by UK mobile networks. Suspicious emails can be sent to [email protected]. These reports help the wider system, but they do not replace a call to your bank if you have already shared information or moved money.

Be especially careful with messages that say a payment is pending, a card has been frozen, or a delivery is waiting. These are common hooks. Check through your bank’s app or official website rather than through the message itself.

A family safe word

A safe word is a simple household safeguard for those moments when someone claims to be a relative in trouble or a caller says they are acting for a family member. Choose a phrase that is not obvious, not reused as a password, and not shared by text or email. It should be spoken, not written into a message that could be forwarded.

A safe word is not a bank security measure. Banks do not generally use family safe words to prove a call is genuine. It is a check within your own family, and it works best when everyone knows the rule: if the phrase is not used, the request waits.

The same principle applies to money requests from friends. A short pause and a separate call to the person on a number you already know can stop a convincing scam before it becomes a payment.

If money has already moved

Act quickly. Call your bank using its official number and ask it to stop the payment and record the fraud. Change any passwords or PINs you have shared. If you have installed software at a caller’s request, disconnect the device from the internet and seek technical help.

Report the matter to Action Fraud in England, Wales and Northern Ireland, or to Police Scotland if you are in Scotland. Keep reference numbers and a written note of what happened. Under the UK rules for APP fraud reimbursement, prompt reporting and cooperation with your bank can matter. Reimbursement is not automatic in every case, and each claim depends on the circumstances.

A short gatekeeper’s checklist

• Pause before you act on any unexpected bank contact.
• Hang up or close the message.
• Verify using a number or app you already trust.
• Never share your full PIN, password or one-time passcode.
• Never move money to a safe account.
• Never allow remote access to your device.
• Report suspicious texts to 7726 and emails to [email protected].
• Tell your bank immediately if you have shared information or made a payment.

The strongest defence is not a perfect memory for scams. It is a settled habit: check first, then act. A bank that is genuine will not object to being verified through its published channels. A fraudster will.