Has someone claiming to be your bank asked for a one-time security code?
Bank impersonation scams can look extremely convincing. A scammer may call, text or email claiming there has been suspicious activity on your account and then ask for a one-time code, PIN, password or other security information.
Common warning signs of a bank impersonation scam
- You are asked to read out a one-time security code. A code sent to your phone may authorise a login, payment or change to your account. Do not give it to someone who contacted you.
- The caller says your account has been hacked. Scammers often create fear by claiming there has been suspicious activity or an unauthorised transaction.
- You are told to move money to a safe account. A genuine bank will not ask you to transfer money to another account to protect it from fraud.
- The phone number appears to be genuine. Caller ID can be manipulated. A call appearing to come from your bank does not prove the caller is really from the bank.
- The text appears in a genuine bank message thread. Scam messages can sometimes appear alongside legitimate messages, making them difficult to recognise.
- You are pressured to act immediately. Claims that you must act now to stop a payment or prevent your account being emptied are designed to stop you from checking.
What is a one-time code?
A one-time code, sometimes called an OTP, verification code or security code, is designed to confirm that you are really the person authorising an action.
If a scammer already has your username, password or card details, that code may be the last thing they need to access your account or approve a transaction.
Treat one-time security codes like passwords. Do not give them to someone who contacts you unexpectedly.
Not sure whether the bank message or call is genuine?
Paste the suspicious message or upload a screenshot to ScamAssessor. It can look for bank impersonation, requests for security codes, urgent account warnings, suspicious links and other scam indicators.
Check it with ScamAssessorHow to check with your bank safely
End the call or stop replying to the message. Do not use a phone number or link supplied by the person who contacted you.
Open your bank's official app yourself, visit its official website directly, or call the number printed on your bank card or another independently verified bank contact number.
If you already shared the code
Contact your bank immediately using an official contact method. Tell them that you may have given a security code or account information to a scammer.
Check recent transactions and follow your bank's instructions for securing the account. Change passwords if they may also have been exposed.
What ScamAssessor looks for
ScamAssessor checks combinations of warning signs including bank impersonation, requests for one-time codes, suspicious transaction claims, pressure to move money, urgent account warnings and suspicious links or contact details.
ScamAssessor provides a risk assessment, not proof. A low-risk result does not prove that a caller, message or banking request is genuine. Verify sensitive requests directly with your bank.
Official information: Scamwatch bank impersonation scam guidance .