The kettle had only just boiled when the doubt crept in. Margaret, a retired teacher in Stockport, had typed her card number into a parcel-fee page that looked exactly like Royal Mail’s. She gave a scammer her bank details at 6.40pm on a Tuesday, and by 6.50pm she was sure of it. Here’s the good news nobody tells you in that horrible first minute: act fast and the law is mostly on your side. This guide walks you through the first hour, step by step.
Your First Hour at a Glance
| First move | Freeze the card in your banking app – instant, any hour |
| Call your bank | 159 (call cost varies) or the number on your card |
| Card details taken | Unauthorised payments refunded; £35 maximum liability |
| You sent money yourself | APP scheme repays up to £85,000 |
| Report the crime | Report Fraud 0300 123 2040; Scotland: police on 101 |
| Extra protection | Cifas Protective Registration, £30 for two years |
| Free support | Victim Support 0808 168 9111, open day and night |
First, Work Out What They Actually Have
Not every leak is equal. A sort code and account number alone cannot be used to pull money out; they exist so people can pay you, though crooks sometimes set up fake direct debits, which the Direct Debit Guarantee lets your bank reverse. Card details are worse, because the long number, expiry date and CVV let a stranger spend online within minutes. Online banking logins and one-time passcodes are worse still, and money you transferred yourself falls under separate rules covered below. Margaret’s trouble began with a delivery text, the kind you can forward to 7726 in seconds — how to report a scam text explains that whole routine. Before you call anyone, write down exactly what you typed and where, because the answer decides which protections apply to you.
Freeze the Card Before You Even Phone
Margaret’s smartest move happened before she spoke to a human. Nearly every UK banking app — Lloyds, HSBC, NatWest, Halifax, Monzo and the rest — has a freeze or lock button that blocks the card instantly, at any hour. Freezing is reversible, so use it even if you’re only half sure something is wrong; direct debits and standing orders carry on as normal while the card itself goes dark. She had entered her details on a fake parcel page, the classic Royal Mail “delivery fee” text scam, and the freeze locked the criminals out while she found somewhere quiet to make the call. Thirty seconds in an app can spare you weeks of arguing over transactions you never made.
Call 159 and Tell Them Everything
Next comes the phone. Dial 159 and you reach your own bank’s fraud team through a safe, memorable route — 26 banks take part, including Barclays, HSBC, Lloyds, Monzo, Nationwide, NatWest and Santander, and the call usually costs the same as a national-rate call. Tell them exactly what you handed over, however embarrassing, because honesty speeds everything up. Your bank can stop pending payments, cancel the compromised card, send a replacement, watch the account for odd activity and even hold a suspicious outgoing payment for up to 72 hours while it investigates. If the details went in through a dodgy link, work through what to do if you clicked a scam link too, since your phone may need the same clean-up as your account.
The £35 Rule for Money You Never Approved
Payments you didn’t authorise are the law’s problem, not yours. Under the Payment Services Regulations 2017, your bank should refund an unauthorised transaction by the end of the next business day, and you must report it within 13 months. The most you can normally be made to pay is £35, and even that is often waived. A bank can only refuse if it shows you acted fraudulently or with gross negligence — far worse than ordinary carelessness — and it must produce evidence, as the FCA’s guidance spells out. Turned down unfairly? Complain, then go to the Financial Ombudsman Service, free, on 0300 123 9123. Money you sent with your own hands follows the bank transfer scam refund rules instead.
You Moved the Money Yourself? The £85,000 Rules
Being talked into pressing send is horribly common, and since 7 October 2024 it has come with real protection. For transfers between UK accounts made by Faster Payments or CHAPS, the Payment Systems Regulator’s scheme requires banks to reimburse authorised push payment scam victims up to £85,000, normally within five business days of a claim, though a bank can pause for up to 35 while it checks. Firms may deduct an excess of up to £100, but never from vulnerable customers, and you have 13 months to claim. In 2025, 61% of APP losses were returned to victims. Claim through your own bank first, and learn your rights under the APP fraud rules before you accept a no.
Lock the Doors They’ll Try Next
Stolen details rarely get used once, so spend the evening closing side doors. Change your online banking password and any account that shares it, and switch on two-factor authentication wherever it’s offered. For £30, Cifas Protective Registration puts a warning flag against your name on the National Fraud Database for two years, so lenders run extra identity checks before approving anything new; applications may take slightly longer, and your credit score is untouched. Keep an eye on your reports at Experian, Equifax and TransUnion over the following months, or go further and freeze your credit file completely. Spotting an unfamiliar loan or card is your cue to act on the next problem: someone opened an account in your name, and that needs its own fix.
The Second Call Is Part of the Same Scam
Two days later Margaret’s phone rang. A calm man from “the fraud team” read out her own card number, then asked her to move her savings to a safe account while they caught the thief. That follow-up call is the real harvest: Which? researchers who entered details on one fake delivery page saw more than £4,000 in fraudulent charges attempted within about two weeks, and the callers use your stolen data as proof they’re genuine. No bank, and no police force, will ever ask you to move money to a “safe account”, reveal a full PIN or password, or withdraw cash. Hang up and redial 159 yourself. The same crews send fake HMRC refund texts, so expect the next costume to look official too.
Tell Report Fraud, Even If You Get Every Penny Back
Reporting can feel pointless once the panic fades, yet it’s how patterns get spotted and mule accounts get shut down. In England, Wales and Northern Ireland, tell Report Fraud — the national service that replaced Action Fraud in January 2026 — online at reportfraud.police.uk at any time, or on 0300 123 2040 between 8am and 8pm on weekdays; in Scotland, call Police Scotland on 101. You’ll get a crime reference number, which strengthens any bank dispute, and understanding how Report Fraud works from there takes the mystery out of it. Fraud cost the UK £1.28 billion in 2025, so you were hit by industrial-scale crime, not personal foolishness. If it has shaken you, Victim Support’s free line, 0808 168 9111, answers day and night.
What Margaret Would Tell You
Margaret got her refund inside a week, a new card soon after, and a Cifas flag that quietly turned away two dodgy applications. If you gave a scammer your bank details today, the order matters: freeze, phone, report, protect. The system now leans your way — banks refund most stolen money, and the rules assume victims deserve their cash back. Do one small thing tonight and save 159 in your contacts, so the safe number is already there if the phone rings.
Frequently Asked Questions
Can a scammer empty my account with just my sort code and account number?
No. Those numbers only let people pay money in. Watch for fake direct debits, though — the Direct Debit Guarantee means your bank must refund any you never authorised.
Will my bank refund money a scammer took from my account?
Usually, yes. Unauthorised payments must normally be refunded by the end of the next business day, and your maximum liability is £35 unless you acted with gross negligence.
Is the 159 number free to call?
Not always. Stop Scams UK says the cost varies by phone provider and is often the same as a national-rate call. It connects you safely to your bank.
How long do I have to claim back a fraudulent payment?
You have 13 months from the payment date for unauthorised transactions, and 13 months from the last payment for authorised push payment scam claims. Report sooner if possible.
How much does Cifas Protective Registration cost?
It costs £30 and lasts two years. Lenders see a warning flag against your details and run extra identity checks before approving anything opened in your name.
Disclaimer: This article is general information, not financial or legal advice. Refund schemes, fees and contact details change, so confirm anything that affects you with your bank, the FCA or the Payment Systems Regulator. Figures correct as of September 2026.
2 thoughts on “What to Do If You Gave a Scammer Your Bank Details”
Comments are closed.