Fraud and Security Centre

Email scams, or phishing, is one of the most common ways for criminals to find victims. These days criminals will send out emails that can look very convincing. It might be that they pretend to be your bank or a utility company, or possibly pose as a builder or solicitor you use. They might also offer you too good-to-be-true investment opportunities or even pretend to be someone you know.

Here are a few tell-tale signs to help you spot a phishing email:

• The sender’s email address doesn’t match the website address of the organisation it says it’s from
• The email is impersonal and doesn’t address you by your name e.g. it just says Dear Sir/Madam
• Informal wording that’s not in the style you would expect from a legitimate company
• There’s a sense of urgency, asking you to act immediately
• There’s a request for personal information, or to confirm or verify your account, or enter your account details, password or PIN
• Emails that claim your account has been compromised or if you don’t respond within a certain timescale your account will be closed
• Emails that ask you to click a link to get access to your account.
• There’s a website link which may seem like the proper company address, but on close inspection is slightly different from the real address
• There are spelling or grammatical mistakes.
• The domain of the email does not match the company that the email purports to be from

A typical example of a phishing scam would be you receive an email from a company that you have previously shopped online with – they tell you that you have won a competition and to click the link the email to claim your prize. You follow the link to the website, which looks similar to the one you had shopped on previously except it is a different URL. You proceed and enter your credit card details, that you had previously used to pay with and all your personal information so they can send you a prize.

Later on you are contacted by your bank to notify you that you have almost spent your entire credit limit. You contact them and learn a large amount of money has been spent on your card.

You now note that the email you received earlier, has a completely different email address to the legitimate company. The criminal has taken your card details and personal information and transacted on your account without authorisation.

If you have received an email which you’re not quite sure about, forward it to report@phishing.gov.uk. Do not click on any links or open any attachments. You can also take a screenshot of the email and send this to the same email address. Emails that have already been picked up by your spam/junk folder do not need to be sent.

Just as with email scams, sometimes it can be very difficult to know if a text message from your bank is real or not.

Criminals will sometimes use a tactic called ‘number spoofing’ where they make it look as if their text is from your bank (or other organisation) – they can even make them appear in the same thread alongside genuine messages.

This is used as another way to hook you in to a conversation and trick you to take action to reveal information or send money.

Some texts may also contain links which may appear valid but will typically go to fraudulent websites. Don’t click any links contained in text messages, instead go directly to the company website from your browser, not through any links sent in messages.

A typical example would be you receive a text from an unknown number, that appears as your mobile phone provider. The text claims you need to update your billing details by following the link or you will be charged a late fee.

You don’t want to incur a fee, so you proceed using the link in the text message. The link does not match to the normal website you use to manage your account, and you do not need to logon – it asks you to enter your card details for payment as well as your personal information.

At this point, the criminal has all your financial and personal details, and now has the ability to spend on your card.

You can forward suspicious text messages to 7726.

Telephony scams, also known as vishing, aim to convince you that you are speaking with a legitimate company.

A typical example would be you receive a phone call to your home from someone claiming to be your broadband or telecommunication provider – they will claim that there is an issue that they need to resolve and ask you to grant them access to your computer.

Once they have access they may ask you to carry out actions, such as logging in to online banking or enter card details through a website in order to pay them for the service – in this time they have managed to capture financial information which will allow them to continue spending or making payments from your account.
 

How to spot a phone scam

When answering a call

Beware of phone spoofing - criminals use sophisticated technology to make the number calling you, appear like it's a genuine number, not their actual caller ID.

Don't assume that because the call sounds genuine, that it is - Criminals can play recorded sounds in the background to make it sound like a call centre.

If you receive a suspicious or unexpected call, always verify it by terminating the call and phoning back using an independently checked phone number, such as one from an official website.

During a call

Never give out the following details to anyone over the phone. Even if they claim to be from your bank or the police. This also includes typing numbers in to your keypad.

• Your mobile banking app activation code and password
• Your full online Banking pin
• Your full online Banking password
• Any details from your credit card
• Never share your bank security details (including passcodes or PIN numbers) we send you in a text or email

If you get anyone ask for these, end the call immediately.

Other things to look out for

Never be persuaded to download any software or visit a site because someone on the phone has told you to. This could be something called pharming. Don't transfer any money at the request of an unexpected caller over the phone.

Don't transfer any money at the request of an unexpected caller over the phone.
 

What to do if it happens?

If a call seems suspicious end it immediately

Don't be rushed on a call. When you're forced to act quickly, it can be easy to misjudge a situation

Don't be afraid to hang up if you feel you're under pressure

Report fraud - Treat this scam as you would with fraudulent emails or SMS's. Report any suspicions right away

If you've been the victim of fraud

Tell us straight away if you've given any details out or think you may be the victim of fraud or a scam. (link to report it page)

This is where criminals persuade customers to hand over their credit and debit cards or to transfer funds from their account. This scam usually involves a call purporting to be from your bank, the police or another financial institution.

The caller may:

• suggest you call the number on the back of your card or 999 for verification (the criminal does not hang up and stays on the line while doing this)
• want to arrange to have your debit and credit cards collected by a courier
• ask you to key in your PIN using your telephone keypad
• advise that another account has been set up to keep your money safe and urge you to transfer your money to the new account immediately
• insist that it is necessary for you to act urgently to protect your funds
• ask you to withdraw and handover cash along with your card as needed for forensic evidence
• ask that you do NOT discuss the reason for withdrawal with bank or travel money staff.

Remote access scams attempt to convince you to allow them access to your Online Banking. These are often cold calls from criminals who say that they're from telecommunication or computer companies or (for businesses in particular) an IT department or Technical Support.

The warning signs are:

• a cold-caller says they can fix your slow computer or refund you money
• an unexpected call from someone claiming to be from your IT department or Tech Support
• the caller asks you to give permission for them to remotely access your computer
• the caller asks for your banking or personal details.

These callers will ask you to log on to your Online Banking, to check it's not been impacted by the fault, and then attempt to remotely access the computer to 'help' you with the problem.

Giving anyone remote access allows them to release malicious software and gain access to personal data.

Don’t agree to download software or an app to your device that allows someone to access it remotely.

Telephone number spoofing is when a caller deliberately falsifies how their phone number appears on the Caller ID to disguise their identity. Criminals are increasingly targeting consumers over the phone; posing as bank staff, police officers and other officials or companies in a position of trust. They try to persuade their victim their accounts are at risk and they must move their money to a new account.

If you question the caller about giving out personal details or moving your money, they ask you to check the caller ID of the phone number they’re calling from, which they have masked, or ‘spoofed’ to look like your bank’s phone genuine number.

Be wary of all contact made out of the blue

This is where someone is persuaded to bank a cheque on behalf of someone else.

This can be a new acquaintance, or friend of a friend, who asks you to bank a cheque, withdraw the funds and pay the cash back to them. . A variation is when selling an item online, the buyer sends a cheque for a greater amount and asks you to forward or transfer back the excess amount.

Although different scenarios the outcome is the same. The cheque normally bounces and the customer suffers the loss.

People persuaded to unwittingly launder money are known as 'money mules'. Criminals look to dupe people into laundering money on their behalf by offering what looks like a legitimate job often advertised on the internet or in the newspapers.

The job involves receiving money into your account and withdrawing those funds and sending the money on, while retaining a proportion of the funds as your commission.

Please be aware that:

• The money you are asked to transfer is normally stolen or the proceeds of crime
• Handling the proceeds of crime could result in criminal prosecution
• Money retained by you as part of the transfer will be recovered from your account, and you may be liable for the full value of the funds you received
• Your accounts could be frozen, and potentially closed, and you may find it difficult to open accounts with other banks

These scams trick online shoppers into thinking they’re dealing with a legitimate contact or company when it’s actually a criminal. Criminals can advertise on genuine selling sites, or even create fake websites that look real. This type of scam normally involves buying scams or selling scams.

Buying scams can happen when you find an item online that you want to purchase. Once payment has been made, the seller disappears, leaving you with either no goods at all, or goods that are less valuable or significantly different to those advertised.

Selling scams can happen when selling items online. You may send the goods as agreed and never receive payment, or you may be tricked into returning an overpayment. The criminal may send you a cheque for a greater value than the value of the item being sold. They ask for the extra money to be transferred back or sent on to a third party, for example a ‘shipping agent’.

Criminals are increasingly manipulating victims in to purchasing gift cards, by impersonating a legitimate source.

For example, you are called by a “HMRC” representative who claims you have outstanding tax debt due to them - this is a scam call. They pressure you and threaten legal action if you do not comply with their demands. They ask you to purchase several gift cards, which total the amount you are due them.

You then go to a shop, where you are able to purchase gift cards, the criminal manipulates you in to doing this, and may even stay on the call with you the entire time. Once you have purchased the gift cards they ask you to take photos of the codes on the cards and send them to the criminal.

Gift cards are for there to be purchased to gift to someone, they are not a form of payment. Genuine organisations will never ask for payments through a gift card.

Romance criminals will create fake profiles on dating websites, or social networking sites in order to start a relationship with a genuine person.

Criminals initially form a deep connection with you, in order to gain your trust and allow you to develop strong feelings for them.

Once they have this, they will ask for financial help, often the criminal will state they live in a different country and need money to cover the expense of their flights, or they need help to look after a relative or they are in trouble legally.

It is important to never send money or purchase something on behalf of someone you have only met online.

Investment scams, offer an opportunity for criminals to trick a victim in to parting with large sums of their money.

You may be contacted by a representative from an organisation, they will promise you exceptionally high returns for your investment – and convince you to part with large sums of your money in order to maximise the profit you will receive.

They may consistently harass you with phone calls and push for further investments from yourself – when you ask for your money to be returned they will decline and no longer contact you.

• All investments involve risk, you could lose some or all of the money you invest. You should only invest what you can afford to lose. If an investment offers very high returns then the risk of losing your money or of this being a scam is much greater.
• You should thoroughly research any company you are considering investing with – you can check the FCA website for regulated companies and their warnings list and Scam Smart test
• An investment is likely to be a scam if they have contacted you through social media, used celebrities images to imply endorsement, have you interact with multiple different companies and rush or pressure you into making payments or investing more and more money.
• You should seek advice from an Independent Financial Advisor if you are planning on making large investments or seeking new investment types.

Criminals may impersonate people who work at the same employer as you. For example, a colleague, your manager, a Company Director, or the CEO. They may email and ask you to purchase gift cards using your own credit card claiming there is a business need for it and request that you send the activation code back to them via email.

Be vigilant of emails claiming to be from your employer asking you to purchase gift cards and you will get your money back later, this will likely be a scam.