Banking Scam Guide: Protect Your Account in 2026

The most common banking scam is the fake bank alert: an SMS or email that appears to be from your bank claiming suspicious activity, a security alert, or an urgent account action. A link in the message leads to a cloned banking login page that captures your username, password, and sometimes OTP. These pages are visually identical to real banking websites and are increasingly hosted on HTTPS domains to appear secure.

Defence: Never click links in banking SMS messages. Go directly to your bank's app or website.

Vishing (voice phishing) involves a phone call from someone claiming to be your bank's fraud team, the police, or HMRC. They present a convincing scenario — your account is under attack, there's a fraudster inside the bank, you must move your money for protection — and guide you through increasingly serious actions: providing card details, reading OTPs aloud, or making bank transfers.

These calls can be alarmingly convincing because criminals can spoof your bank's actual telephone number, and may know enough personal details (from data breaches) to seem legitimate. They create urgency: "We need to act in the next few minutes before the fraudster completes the transfer."

Defence: Hang up and call your bank back on the number on the back of your card. Always. No matter how urgent it seems.

One-time passwords (OTPs) sent by SMS are a security layer between fraudsters and your money. Criminals circumvent this in two ways. In social engineering OTP theft, the fraudster who already has your username and password calls you, claims to be from the bank verifying suspicious activity, and asks you to "confirm" the OTP that just arrived on your phone — actually logging into your account using the code you just provided.

In SIM swap attacks, the criminal contacts your mobile network, impersonates you, and convinces them to transfer your phone number to a new SIM they control. They then receive your OTPs directly. Protect against this by switching from SMS-based 2FA to an authenticator app, and adding a security PIN to your mobile account.

APP fraud is the fastest-growing banking fraud type in the UK. It involves tricking the victim into willingly authorising a bank transfer to an account controlled by fraudsters. Common scenarios include: an invoice payment to a supplier that has been intercepted and bank details changed (invoice fraud), a deposit for a rental property or car that doesn't exist, a courier fee or administration charge for a prize, or moving money to a "safe account" on police or bank instructions.

Because the victim authorises the payment, banks historically argued they weren't liable. New UK rules from October 2024 now require banks to reimburse APP fraud victims up to £85,000 in most cases — a significant consumer protection improvement.

ATM skimming involves attaching devices to cash machines that covertly capture card details and PIN numbers. The skimmer reads the magnetic stripe on your card while a hidden camera or overlay keypad records your PIN. Fraudsters then clone your card and withdraw cash. To protect yourself: inspect the card slot for loose or unusual attachments, cover the PIN pad when typing your number, use ATMs inside bank branches when possible, and check your statements frequently for unexplained withdrawals.

Fraudulent banking apps appear in third-party app stores or are promoted via phishing messages and social media ads. They look like your real banking app but are designed to capture your login credentials. In 2026, some fake apps use legitimate bank branding obtained through clone websites. Always download banking apps directly from the official app stores (Google Play or Apple App Store) and verify the developer matches your bank's official name.