“This is the bank’s fraud team. We need to move your money.”
One sentence settles this, and you can act on it before you finish reading the page. No bank asks a customer to move money to a safe account. There is no such account. A bank that is genuinely protecting you freezes what you already have; it does not ask you to send it somewhere.
Hang up and call back on a number you already have — the one printed on your bank card, or the call button inside your banking app. Never a number the caller reads out, and never by pressing a key to be “transferred”. A clone cannot answer a phone you dialled. If the call was genuine, the bank will simply pick up where it left off.
Things a real bank will never ask you to do
- Move money to a new, safe or holding account. Not to protect it, not while an investigation runs, not for any reason at all.
- Read out a one-time passcode. The message containing it usually says so itself. Staff cannot use it and never need it.
- Give your full PIN or password, or type them into the keypad during a call.
- Install remote-access software so someone can “show you” the problem or “help secure” your device.
- Withdraw cash, buy gold or buy vouchers as part of an investigation, or hand anything to a courier sent to your door.
- Keep the call secret from your family or from branch staff, or pretend to a cashier that the money is for something else.
If any of those was asked, the call was fraudulent, regardless of how professional it sounded and regardless of what your phone displayed.
Why the caller ID matched
This is the part that convinces people, so it is worth understanding properly.
The number you see on an incoming call is not a fact the network verifies about the caller. It is a label that travels with the call, and on a lot of routes it can be set to almost any value. That includes your bank’s published fraud line, a local police number, or the number stored in your own phone — which is why the call can appear under a contact name you saved yourself. Networks and regulators have been narrowing the gaps, unevenly and slowly, and the practical position for you today is unchanged: an incoming number is a claim, not identification.
A number you dial is different in kind. When you place the call, the network decides where it goes, and neither the label nor the caller can redirect it. That asymmetry is the whole reason the callback rule works, and it is why “press 1 to be connected to our fraud team” is worthless — you have not left their call, you have stayed on it.
One older piece of advice deserves updating. People used to be told to wait five minutes before calling back, because a caller could hold the line open. On mobiles and modern networks this is largely historical, but if you want to remove the doubt entirely, use a different phone. Ring from a mobile if the call came to a landline, or ask a neighbour. It costs nothing to be certain.
Where the cloned voice comes in
Most of these calls have always been a live person with a script, a call-centre background track and some accurate detail about you — a recent transaction, a card ending, the name of your branch — taken from a data breach or a preceding phishing message. That is enough to sound official, and it always was.
What synthetic voice adds is a specific, narrower attack. If you have dealt with a named adviser before, or if a firm has a recognisable voice on its own recordings, that voice can be reproduced. The effect is not that the call sounds more like a bank; it is that it sounds like your bank, spoken by someone you have already trusted once. It also removes accent and fluency as clues, which some people had been quietly relying on.
None of this changes what you do. The countermeasure is the same for a synthetic voice, a live fraudster and a genuinely confused member of staff: leave the inbound call and dial a number you control.
The next five minutes, if money has moved
Call the bank on the card number and use the words “authorised push payment fraud”
That phrase routes you to the right team immediately. Ask them to attempt recall and to freeze the account. Speed matters more than anything else you do today.
Write down the details before they fade
The time, the number displayed, the names given, the sort code and account number you were sent to, and any reference the caller used.
Secure the account and the device
Change your online banking password from a device that was not involved. If you installed anything during the call, disconnect that device from the internet and get it looked at before using it for banking again.
Report it
[VERIFY: link the national fraud reporting bodies for your markets — verify every URL before publishing]
Reimbursement rules for authorised transfers differ by country and are changing. [VERIFY: cite your market’s reimbursement rule — e.g. the UK APP reimbursement requirement, or the equivalent for your market. Link it and date it.] Report it even if you are told the money is gone, because the receiving account is evidence about someone else’s case as well as yours.
Afterwards
If the call was recorded, or if it left a voicemail, keep the original file rather than a copy forwarded through a chat app, and you can have it checked. A result saying the speech looks generated is useful context for your report and for your own peace of mind. Be clear about what it is not: it arrives after the money has moved, and call audio is the hardest thing we assess. The callback prevents. The check explains.
Questions
Would my bank ever ask me to move money to a safe account?
No, in any country, under any circumstances. It is the clearest single test there is.
They knew my recent transactions. How?
Usually from a data breach, an earlier phishing message, or details you gave in the first minute of the call without noticing. Knowing something about you is not proof of who someone is.
They told me not to tell the cashier what the money was for.
That instruction only exists to get you past someone trained to stop this. Nothing legitimate requires you to mislead your own bank staff.
Can I tell a cloned voice by listening?
Generally no, and trying keeps you on their call while you deliberate. Verify the channel instead of the voice.
I gave out a code but no money left. Am I fine?
Call the bank now anyway. A code can be used to add a device, change a limit or authorise a payee, and none of those show as a transaction straight away.
Reviewed