Santander UK phishing scams: reporting, refunds and recovery

A convincing call, text or email that uses Santander UK's branding is still untrusted until you verify it independently. The safest rule is simple: stop the contact, open the bank through a channel you already know, and never approve a payment or reveal a one-time code because an inbound caller says your account must be secured.

Do not trust branding, caller ID or security codes

Fraudsters can copy Santander UK logos, use realistic language and spoof a phone number so it appears familiar. Treat the content of the request as the test: a demand for a full password, PIN, verification code, remote-access software or a transfer to protect money is a reason to stop.

Do not let the caller tell you how to verify them. If they say 'call the number on the back of your card but stay on the line', disconnect and use another phone if necessary. The verification route must be independent of the person who initiated contact. For this impersonation incident at Santander UK, keep the provider reference beside the exact transaction or account event so later support can follow the same chronology.

A one-time code from Santander UK is not a password you can safely read to a fraud investigator. The message often states what the code is authorising - a payment, new device, wallet or profile change. If that action is not yours, do not approve it and contact the bank.

Scammers deliberately create panic so customers read only the digits. Slow down and read the whole message. A genuine code can still be used by a criminal if you hand it over.

Safe-account transfers and remote-access scams

If somebody says £1,180 is at risk and must be moved from Santander UK to a new 'secure', 'holding' or 'police' account, stop. Banks and police do not protect deposits by instructing customers to transfer them to an account controlled by a caller.

If you already sent the transfer, switch from phishing prevention to APP-scam response immediately: contact the bank, give the exact payment details and ask it to start recovery and register the scam claim. Preserve the caller number and messages. When the sending bank is Santander, use Santander's official fraud-reporting route immediately and do not continue the conversation with the caller or message sender.

If the caller persuaded you to install AnyDesk, TeamViewer or another remote-control tool, disconnect the device from the internet and use another trusted device to contact Santander UK. The criminal may have seen banking screens, email, saved passwords and authentication messages.

Removing the app icon is not necessarily enough. Follow trusted device-security guidance, change important passwords from a clean device and review email forwarding rules or new devices. Your email account is often the key to resetting multiple financial services. For this impersonation incident at Santander UK, save the relevant app status and case reference together; that makes any later complaint easier to reconstruct accurately.

Worked example and provider security cues

A text says '£75 card payment blocked - if this wasn't you call now' and shows a number that looks like Santander UK. You call it, and the adviser knows your name before asking for a verification code. End the call. Open Santander UK independently and check whether any real transaction or secure message exists.

If nothing exists, report the phishing attempt through the bank's current route and forward the text to 7726 where appropriate. If a real unknown transaction is present, report the fraud separately; the suspicious message and the transaction may be connected but require different actions. For this impersonation incident at Santander UK, keep the final bank response with the underlying statement entry until the money and account status have fully reconciled.

Use the provider’s current fraud-and-security page to check how it says it will contact customers and which channels it uses for verification.

Santander combines Mobile Banking, Online Banking, Sandi chat, telephone and branches. For a payment or security problem, use the route that preserves the clearest transaction record and keep the bank reference with the statement entry until the case is fully reconciled. Never assume an app notification is safe merely because it appears at the same moment as a phone call; criminals may be attempting a real login and asking you to approve it.

Protect data, record the incident and follow up

Santander says nobody from the bank, including its fraud team, will ask for your PIN or a one-time passcode. It accepts reports of suspicious Santander-branded email and text messages through dedicated phishing/smishing routes, and suspicious texts can also be forwarded to 7726.

Do not use the telephone number or link contained in the suspicious message to verify it. Open the Santander app or website independently, or use a number you already trust. If you already shared security details, report the exposure immediately even if no money has left the account yet.

Write down when the contact started, the number or address used, what the scammer claimed, what information you shared and whether any payment was made. If a complaint or reimbursement claim follows, that chronology is more useful than trying to reconstruct the conversation days later. For this impersonation incident at Santander UK, save the relevant app status and case reference together; that makes any later complaint easier to reconstruct accurately.

Keep screenshots but do not continue engaging with the scammer to collect more evidence. Once you have enough to report the incident, block the contact and let the bank or police handle further investigation.

• Stop the inbound contact
• Verify the bank independently
• Never share one-time codes
• Never move money to a safe account
• Secure the device if remote access was installed
• Write down what information or money was exposed

Create a short incident timeline while the details are fresh: the number or address that contacted you, what they claimed, every code or piece of information you disclosed, each payment and the moment you realised the contact was false. Give Santander UK that sequence rather than repeatedly retelling the story from memory; it is clearer for both the fraud team and any later complaint.

No financial loss does not mean the incident is finished. If you disclosed a Santander security code, password detail or card information, secure the relevant account and email from a trusted device, then review recent payees and card activity. Treat any later call offering to 'finish the recovery' as a fresh contact that must be verified independently rather than as proof the original caller was genuine.

Sources and verification

• Santander UK - official website
• Santander UK - official phishing guidance
• Financial Ombudsman Service - banking and payments
• Financial Ombudsman Service - complaint time limits

Santander UK: fraud contact methods evolve quickly. Use the bank's current security centre and verified contact page rather than phone numbers or links supplied in an unexpected message.