Verify a bank callback safely before sharing details
A callback is safe only when you control how the bank is reached. Calling a number supplied in the suspicious text or by the original caller merely reconnects you to the same potential scam. Verification means starting a new contact through the bank’s official app, card, statement or independently typed website.
End the original call. Do not use a number the caller gave you. Open the bank app and use its help/contact function, or call the number printed on your card or statement. Explain that you are independently verifying an earlier call before discussing or approving anything.
The important step is breaking the original contact
Scammers create momentum. They keep you on the line while sending texts, transfer requests or app notifications so every new event appears to confirm their story. Hanging up interrupts that controlled environment.
Do not worry about seeming rude. A genuine bank agent can record the case and expect you to reconnect safely. A fraudster needs you to remain inside the conversation they control.
Start with a real-world test rather than the label on the screen. Picture a caller claiming to be from the fraud team and asking you to stay on the line while they transfer you internally. For 'The important step is breaking the original contact', write down the time of the call, claimed department, case reference and the official contact route you choose yourself before changing anything. A safe callback breaks the original communication chain: you choose the second route rather than using a number, link or transfer supplied by the caller. If the caller says £900 is at risk, hanging up for two minutes to make an independent call does not make a genuine bank investigation disappear
Choose the second contact route yourself
The NCSC advises contacting an organisation directly using details from its official website rather than the suspicious communication. For banking, the app, the number on the back of the card or a statement are stronger starting points than a number in a text.
If the caller says “call me back on my direct line”, that is not independent verification. You are still relying on information supplied by the person whose identity you are trying to verify.
Treat 'Choose the second contact route yourself' as a sequence of checks. Using a caller claiming to be from the fraud team and asking you to stay on the line while they transfer you internally, separate what is confirmed from what is only assumed, then compare the expected result with the actual result. Keep the time of the call, claimed department, case reference and the official contact route you choose yourself. If the caller says £900 is at risk, hanging up for two minutes to make an independent call does not make a genuine bank investigation disappear If the evidence does not line up, pause before you create another payment, application or instruction because a second action can make the original problem harder to trace.
Do not use security codes as proof that the caller is genuine
A fraudster may trigger a real banking code and then ask you to read it back. The fact that the code genuinely came from your bank does not authenticate the caller; it can mean the criminal has initiated a real action on your account.
Read the wording around any code or app approval. If it says you are adding a device, approving a payment or changing security settings and you did not start that action, reject it.
A useful decision rule for 'Do not use security codes as proof that the caller is genuine' is to take one controlled action at a time. Never treat caller ID, account knowledge or a one-time code request as proof that the caller is genuine. In the example of a caller claiming to be from the fraud team and asking you to stay on the line while they transfer you internally, the next step should preserve the time of the call, claimed department, case reference and the official contact route you choose yourself and leave you able to reverse course if new information appears. End the original call and reconnect through the number in the banking app, on the card or on the official website.
When you reconnect, explain the sequence before giving new information
Tell the bank that an unexpected caller claimed to be from its fraud team and describe what the caller asked you to do. Ask whether there is a genuine alert or case on the account. Do not begin by volunteering full security information beyond what the bank’s normal authentication process requires.
If the original caller knew recent transactions, mention that too. It helps the bank assess whether card, account or personal data may already have been exposed.
Build the fallback before the deadline becomes urgent. For 'When you reconnect, explain the sequence before giving new information', decide what you will do if the normal route fails: which official channel you will contact, which reference you will quote and what money or account access must remain available. If the caller says £900 is at risk, hanging up for two minutes to make an independent call does not make a genuine bank investigation disappear Keep the time of the call, claimed department, case reference and the official contact route you choose yourself together in one dated note so support can see the sequence without asking you to reconstruct it from memory.
If the first call led to a payment, verification becomes urgent reporting
If you transferred money, approved a card payment or disclosed credentials, tell the bank immediately. The issue is no longer merely whether the caller was genuine; it is also whether a payment can be stopped, recovered or claimed under the relevant fraud rules.
Preserve the call log and messages. Avoid deleting them while you are embarrassed or angry; evidence is more useful than a clean inbox.
Do not treat documentation as paperwork that comes after the problem. Under 'If the first call led to a payment, verification becomes urgent reporting', the time of the call, claimed department, case reference and the official contact route you choose yourself are part of the solution because they show the bank what happened and when. Never treat caller ID, account knowledge or a one-time code request as proof that the caller is genuine. End the original call and reconnect through the number in the banking app, on the card or on the official website rather than improvising with an unverified workaround.
The safest callback is one you initiate independently
Caller ID can be spoofed, so a familiar bank number on the screen is not proof of identity. If somebody calls about fraud, tell them you will call the bank back, end the call and use a number from the bank's app, website or the back of the card. Do not use a number the caller dictates and do not let them keep you on the line while you dial another number.
A genuine bank may need to verify you when you reconnect, but it should not require you to read out a full PIN, password or one-time code sent to authorise a transaction. Read the entire security message before using a code. If it says the code is for a new payee, wallet or transfer you did not initiate, stop and tell the bank.
If the caller already knew your postcode, balance or recent merchant, do not let that override the verification process. Personal information can come from data breaches or previous phishing. NCSC guidance specifically recommends contacting the organisation directly using independently sourced details whenever a message or call makes you suspicious.
Finish 'The safest callback is one you initiate independently' with a stop condition. Decide in advance what fact would make you wait, what fact would make you contact the bank and what fact would make you abandon the transaction or application entirely. In a caller claiming to be from the fraud team and asking you to stay on the line while they transfer you internally, the safest next step is the one that keeps essential money and evidence recoverable. A safe callback breaks the original communication chain: you choose the second route rather than using a number, link or transfer supplied by the caller. End the original call and reconnect through the number in the banking app, on the card or on the official website if the provider cannot explain the next step clearly.
Sources and verification
Victoria Hughes - Consumer Rights Specialist
A safe callback is not “calling the person back”. It is rebuilding the contact from a source the first caller did not provide. Once you make that distinction, most impersonation tactics become much easier to resist.
MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.