Gave Your Bank Details to a Scammer: What to Do Now

If you have given your bank details to a scammer, the first thing to do is call your bank. The National Cyber Security Centre (NCSC) is direct about it: if you have lost money or given a scammer your financial details, contact your bank immediately¹. Do not use any phone number or link that came with the message or call that caught you out. Use the number on your bank statement, on the back of your card, or the bank's own app.

Then watch your account closely for payments you did not make, and report the crime. If you have lost money, tell your bank straight away and report it to Report Fraud, or in Scotland contact Police Scotland². If you use online banking, you can often cancel your card yourself in the app or website while you are waiting to speak to someone³.

Expect the scammer, or someone working with them, to try again. Follow-up calls pretending to be from your bank are a known part of how these frauds work⁴. The sections below take each step in turn, in the order you need them.

What to tell your bank when you call

When you get through, say plainly that you have given your bank details to a scammer. Tell them what you shared (card number, account number, sort code, a password, a one-time code), how it happened (a call, a text, an email, a website), and when. If money has already left your account, say so and give the amounts and dates. The bank can then act on the account rather than working it out from scratch.

Use only contact details you have looked up yourself. The NCSC warns that if you have received a suspicious call or message pretending to be your bank, you should not use the contact details provided or click any links you are sent⁶. The same applies when you are the one making contact: go to the bank's official website or app, or use the number printed on your statement or card.

If you have lost money, the bank is not the only call. The NCSC advises telling your bank straight away and reporting it to Report Fraud, or in Scotland contacting Police Scotland². If you have not lost money but your details are out there, the bank can still flag the account and tell you what to watch for.

If you use online banking, you may be able to do part of this yourself before you speak to anyone. If you use online banking, you can cancel your card or cards online¹. That buys time while you wait on the phone.

Watching your account for payments you did not make

Once the bank knows, your job is to keep looking. Check your bank statements and online shopping accounts for unauthorised purchases and unusual transactions, and contact your bank directly using contact details from its official website or social media channels⁸. Do this for a few weeks, not just the first day, and check every account the details could touch, including any store cards or shopping accounts that hold the same card.

The NCSC lists the signs of unauthorised activity to look for: changes to your security settings, messages or notifications sent from your account that you do not recognise, logins or attempted logins from strange locations or at unusual times, and unauthorised money transfers or purchases³. A payment you do not recognise, however small, is worth a call.

If you have been through a data breach, the advice is the same: check your online accounts to see if there has been any unauthorised activity⁹. If phone numbers were among what was stolen, you might get a suspicious call asking for banking details or passwords, or for access to your computer¹⁰. Treat any unexpected call that asks for those things as hostile, whoever it claims to be.

Keep a simple record as you go: the date, what you saw, what you did and who you spoke to at the bank. It helps if you need to follow anything up.

Reporting the scam to Action Fraud

Reporting is a separate step from telling your bank, and both matter. If you have lost money, tell your bank and report it as a crime to Report Fraud, the UK's reporting centre for cyber crime³. In Scotland, the route is different: contact Police Scotland instead².

The Action Fraud number, 0300 123 2040, is also given in local emergency planning guidance as the number to call if you suspect a scam¹². Have your dates, amounts and any reference numbers ready when you report.

If the scam came by email or text, report the message as well as the crime. Forward suspicious emails to report@phishing.gov.uk, and the National Cyber Security Centre will investigate⁵. Suspicious text messages should be sent to 7726, which is free¹³. You can also report suspicious websites through the GOV.UK reporting service¹⁴. There is more detail on how to report a phishing email and how to report a scam text message if you want to do that first.

Changing passwords and locking the account down

If you entered banking or card details on a link or form, contact your bank straight away, and if you use online banking, cancel the card or cards there³. Then change passwords. The NCSC advises changing the passwords on any of your accounts where you use the same password³. Start with your bank, then your email, because if a criminal can access your email account they could reach private information about you, including your banking details, send messages pretending to be from you, and reset your other account passwords¹⁵.

If a scam message quotes a password you recognise, the NCSC says it has probably been discovered from a previous data breach, and you can check at haveibeenpwned.com¹⁶. Change that password immediately and anywhere else you used it¹⁷.

A few habits reduce the risk next time. Keep anti-virus software and a firewall up to date, and do not trust emails asking you to confirm bank details¹². Strong, hard-to-guess passwords are part of the same picture¹⁸. If you want help with that, see how to create a strong password you can remember and how to turn on 2-step verification.

Spotting the follow-up scam calls that often come next

A scam that gets your bank details is often followed by a second approach. In a courier fraud case studied by Wiltshire Police, victims received additional calls pretending to be from their bank, to further legitimise the crime⁴. The second call is designed to feel like help arriving. It is not.

The pattern is consistent. If phone numbers are stolen, you might receive a suspicious call asking for banking details or passwords, or for access to your computer¹⁰. The approach may be more direct, asking you for sensitive information such as banking details or passwords, or access to your computer⁹. Criminals are always finding new ways to trick people into sharing personal details or money, and may pretend to be a utility company and contact you by phone, email, WhatsApp or text message¹⁹.

If someone calls claiming to be your bank, hang up and call the bank back on a number you have looked up yourself. If you are unsure whether a message is genuine, see how to check a message from your bank is genuine and how to spot a scam phone call. You can also read about how to block nuisance and scam calls.

Watch for the signs in someone else too, particularly an older relative. Receiving lots of unwanted calls is one of the warning signs that someone has been targeted, along with unusual transactions on bank statements, becoming unwilling to go out, having no money to buy food or pay bills, lots of mail, and being unwilling to throw old post away²⁰. If you see those signs, help them call the bank and report it.

If the scammer is still in touch

Do not reply, and do not engage to "waste their time". Report the contact and then cut it off. Do not click on any links you are sent⁵. For calls, hang up and report the number through your phone provider's nuisance call service where one is offered.

If you have already paid money, report it. The NCSC says that if you have already paid a ransom, visit Report Fraud for further advice¹⁶. The same principle applies to any payment a scammer has talked you into: tell your bank and report it as a crime.

Where to get help

If you are not sure what to do next, start with your bank, then Report Fraud or Police Scotland. The NCSC has guidance on recovering a hacked account or service that is worth reading before you need it²¹. If your details were exposed in a breach rather than given away directly, see your details in a data breach.

For the wider picture of how to protect the household, the cyber attacks section covers phishing, hacked accounts, passwords and more. If a scam has left you short while you wait for the bank, paying for essentials when card machines and banking apps fail explains the practical options.