It is 10.40pm, you are half watching the telly, and a text says your parcel couldn’t be delivered. Or your bank wants to confirm a payment you don’t recognise. You tap the link, type in a few details, and a second later your stomach drops. That wasn’t the bank.
Websites get hacked, customer databases leak and criminals send millions of convincing messages a day. You can’t fix any of that. What you can control is how quickly you act once something goes wrong, and that speed often decides whether you get your money back.
What should I do if I clicked a phishing link?
First, don’t panic and don’t feel stupid. These messages are written by people who do this all day for a living.
If you only clicked and typed nothing in, close the page. Don’t download anything it offers. Run your phone or computer’s security updates and move on, but keep a closer eye on your accounts for a few weeks.
If you entered a password, change it now, starting with your email account. Whoever controls your email can reset almost everything else. Then change the password on any other account where you used the same one. Turn on two-step verification wherever it is offered.
If you typed in card details, bank login details or a one-time passcode, go straight to the next section. That is a call to your bank, tonight, not tomorrow morning.
Call the number on the back of your card
This is the one rule worth taping to the fridge. When you need your bank, use the number printed on the back of your card, on your statement or on the bank’s own app. Never the number in the text, email or voicemail that worried you in the first place.
Better still, ring 159. It is a short number run by Stop Scams UK that connects you to the fraud team at most of the big high-street banks and building societies. Criminals can’t easily fake it, because you dialled it yourself.
One more trick to know: fraudsters sometimes keep the line open after they’ve called you, so when you “ring the bank” you are actually still talking to them. Hang up, wait a few minutes or use a different phone, then call.
Tell the fraud team exactly what happened. They can freeze cards, block online banking, stop payments still in progress and flag your account. The sooner they know, the more they can claw back.
Your bank will never ask you to move money to a safe account. Anyone who does is a criminal, whatever the caller ID says.
Will my bank refund me if I’ve been scammed?
It depends on what kind of fraud it was, and the difference matters.
Unauthorised payments are ones you didn’t make: a criminal used your stolen card details or logged into your account. Under the Payment Services Regulations, your bank should normally refund these promptly. The exceptions are if you acted with gross negligence, which is a high bar, or if you delay reporting for more than 13 months.
Authorised push payment fraud, or APP fraud, is where you were tricked into sending the money yourself. The fake builder’s invoice, the bogus investment, the “safe account” con. For years, refunds were patchy. Since 7 October 2024, payment firms in the UK have had to reimburse victims under rules set by the Payment Systems Regulator.
The headlines of that scheme:
It covers payments made by Faster Payments and CHAPS between UK accounts, which is how most bank transfers go.
The maximum refund is £85,000 per claim. That covers the vast majority of cases, though not a house deposit gone astray in a conveyancing scam at the top end.
Your bank can deduct an excess of up to £100. It can’t do so if you are classed as a vulnerable customer.
You need to claim within 13 months of the last fraudulent payment.
Refunds should usually arrive within five business days, though the bank can extend that while it investigates.
The cost is split between the bank you sent the money from and the one that received it, which gives both a reason to take fraud seriously.
There are limits. You can be refused if the bank shows you were grossly negligent, for instance by ignoring clear, specific warnings from the bank or police. The scheme doesn’t cover card payments, international transfers or civil disputes, such as a genuine builder who did a poor job. For card purchases, chargeback and, on items between £100 and £30,000, Section 75 of the Consumer Credit Act can help if you paid by credit card.
If your bank says no or drags its feet, you can complain formally. If you’re still unhappy after eight weeks, or with the final answer, take it to the Financial Ombudsman Service. It’s free.
How do I report fraud in the UK?
Once your bank knows, report it to the police. In England, Wales and Northern Ireland that means Action Fraud, the national fraud reporting centre, on 0300 123 2040 or online. You’ll get a crime reference number, which is useful for your bank and any insurer.
Scotland does it differently. Report fraud to Police Scotland on 101, or 999 if a crime is happening right now.
A few other free reports take seconds and help stop the next victim. Forward scam texts to 7726. Forward suspicious emails to report@phishing.gov.uk, run by the National Cyber Security Centre. If the scam involved a fake investment or a firm pretending to be authorised, tell the Financial Conduct Authority, whose ScamSmart pages also let you check a firm before handing over money.
Locking the door after a breach
Even if no money has gone, leaked details can be used later for identity fraud, such as taking out credit in your name.
Check your credit report. The three main credit reference agencies all offer a free version, and new accounts or searches you don’t recognise are the red flag.
Consider Cifas Protective Registration if your identity details have been compromised. It adds a warning to your file so lenders do extra checks before approving credit in your name. It costs £25 for two years.
Look at your pension and investments too. Fraudsters target people in their 50s and 60s precisely because that’s where the money sits. Log in, check the contact details and bank account on file haven’t been changed, and be wary of anyone cold-calling about a pension review or a guaranteed return. Unsolicited pension calls are illegal.
Finally, a few habits that cut the risk: use a password manager so every site has a different password, keep your phone and computer updated, and treat any message that creates urgency as suspect until proven otherwise. Urgency is the scammer’s favourite tool. A genuine bank will happily wait while you hang up and call back.
If a scam has shaken your finances, MoneyHelper offers free, impartial guidance, and its scams pages explain your options in plain English.
In short
If you’ve clicked a phishing link or spotted strange activity, call your bank’s fraud team immediately using 159 or the number on the back of your card, never a number from the message. Since 7 October 2024, most victims tricked into sending money by bank transfer must be refunded up to £85,000, minus an excess of up to £100, if they claim within 13 months. Then report it to Action Fraud on 0300 123 2040, or Police Scotland on 101, and lock down your email, passwords and credit file.
Sources
