Bank called you? Hang up and call back safely

How the fake “fraud department” call works

The caller says they are from your bank, and sometimes the police or a credit agency. They say your account has been hacked or someone is spending your money. Canada’s Anti-Fraud Centre describes what happens next: they ask to get into your computer to “investigate”, show you a fake transaction, then ask you to move money to protect it or to help catch the criminals. Some ask for the code your bank just texted you, which is exactly what lets them into your account. Some even send someone to your home to collect your card.

The FBI warned on 25 November 2025 that criminals posing as bank staff, customer support or tech support trick people into giving their login details and one-time passcodes, and sometimes pass them to a second person posing as law enforcement. It said its Internet Crime Complaint Center had received more than 5,100 complaints about this kind of account takeover since January 2025, with losses over $262 million.

Why you hang up, even if the number looks right

The number on your screen proves nothing. Canada’s Anti-Fraud Centre says criminals use “call spoofing”, so you shouldn’t assume the number on your call display is accurate, and the FBI says don’t trust caller ID: hang up, check the correct number and call it yourself. The Anti-Fraud Centre adds a detail worth remembering: call back from a different phone if you can, or wait 10 minutes before you dial.

In the UK, 159 is a short number that connects you to your own bank. Stop Scams UK says it reaches the customers of more than 99% of UK retail current accounts, that it can’t be spoofed, and that 159 will never call you. The banks on its list on 5 November 2026 are in the bank picker above. If yours isn’t there, use the number on the back of your card.

What banks and police say they never ask for

• Your PIN or your online banking password. An Garda Síochána says your bank will never ask for them.

  Sources: An Garda Síochána · National Cyber Security Centre (UK)

• A one-time code from a text or email. The FBI says companies generally don’t contact you to ask for your username, password or one-time passcode.

  Sources: FBI Internet Crime Complaint Center (IC3) · Canadian Anti-Fraud Centre

• To transfer your money, for example to a “safe” account. The Gardaí say your bank will never ask you to transfer money, and the FTC says it will never tell you to move money to “protect it”.

  Sources: An Garda Síochána · FTC

• To come to your home to collect your card, cheque book or cash.

  Source: An Garda Síochána

• To confirm your personal information or account details by email or text. The FCA says a bank will never do that.

  Sources: Financial Conduct Authority · National Cyber Security Centre (UK)

• Threats. Canada’s Anti-Fraud Centre says banks, credit bureaus and law enforcement will never threaten you over the phone.

  Source: Canadian Anti-Fraud Centre

Will you get your money back?

United Kingdom: APP fraud reimbursement

If you were tricked into sending money by bank transfer (an “authorised push payment”, or APP), the Payment Systems Regulator’s rules have covered payments made on or after 7 October 2024 by Faster Payments or CHAPS between UK accounts. As the PSR’s consumer page read on 5 November 2026:

• You can claim up to £85,000; firms may choose to pay more.
• Firms may take an optional excess of up to £100, but not from vulnerable customers.
• Claim within 13 months of the payment. Most people can expect to be repaid within 5 business days; a firm can “stop the clock” to ask questions but must decide within 35 business days.
• You won’t be repaid if you were part of the fraud or “grossly negligent”, which the PSR calls a high bar; that exception doesn’t apply to vulnerable customers.
• Card, cash and cheque payments have their own protections, and credit unions, municipal banks and national savings banks aren’t part of the scheme.
• If more than £85,000 isn’t repaid, you can take it to the Financial Ombudsman Service, whose limit is £430,000.

The government has decided to abolish the PSR and move its work into the Financial Conduct Authority, which needs a new law (HM Treasury, 21 April 2026). The FCA’s page on payments regulation, updated 18 September 2026, says there will be no immediate changes to the PSR’s remit, and the PSR’s consumer page still set out these rules on 5 November 2026. Check the PSR’s or FCA’s site before you claim.

United States: Regulation E

Regulation E protects you against unauthorized electronic transfers, which it defines as transfers started by someone other than you, without your authority. The CFPB says that if a scammer tricks you into sharing your login details or a code and then makes the transfer, that counts as unauthorized. Your liability is capped at $50 if you tell your bank within two business days of learning your card or code was lost or stolen, and you should report unauthorized transfers on a statement within 60 days of it being sent.

A payment you sent yourself, even because you were tricked, doesn’t fit that definition, so your bank may treat it differently. Report it to your bank at once anyway: the FTC says to ask the bank or payment app to reverse it.

Canada, Australia and Ireland

We haven’t listed refund rules for these countries because we couldn’t confirm them on an official page. Contact your bank at once. In Australia, Scamwatch says that if you’re unhappy with how your bank responded, you can complain to the Australian Financial Complaints Authority.

Common mistakes

• Staying on the line to “just check”. Anything they say can be scripted. Hang up first.
• Believing they know your card number. Canada’s Anti-Fraud Centre notes that the first 4 to 6 digits only identify the bank that issued the card, so a scammer quoting them proves nothing.
• Reading out a code “to cancel a payment”. A code you read out lets them in. The FBI says companies generally don’t ask for it.