How to avoid falling victim to bank transfer fraud


    A bank transfer scam, also known as an authorised push payment (APP) scam, is when money is transferred from your bank account to a fraudster. It could be due to a payment that you sent in good faith or money that was taken without your knowledge. There were over 84,000 cases of bank transfer fraud last year in the UK, with around £228m stolen from individuals.

    What are banks doing to protect their customers?
    Until now banks were not always able to reimburse customers if they had fallen victim to an APP scam, but from 28 May 2019 a new voluntary scheme came into force. More victims of fraud will be reimbursed, but both banks and customers have to take certain steps to stop fraud happening in the first place. For example, your bank must give you information to help you keep your money safe, and you have to do all you can to be sure the person or organisation you are paying is genuine.

    Most UK banks have signed up to the scheme, but not all of them.

    Find out if your bank has signed up

    How you can protect yourself against bank transfer fraud
    Most people assume they would never fall for an APP scam, but scammers are becoming more and more sophisticated. Techniques they use include:

    • Telling you you’ve been a victim of fraud to make you panic and gain your trust.
    • Knowing some personal information about you, such as your date of birth or mother’s maiden name.
    • Giving a time limit or a deadline within which you need to take action.

    Can you spot fraud? Try the Take Five test

    5 tips for avoiding falling victim to bank transfer fraud:
    1. Never call a number you don’t recognise
    Your bank will never ask you to call a number you don’t recognise. If you receive an email or text supposedly from your bank, call them from the number on their website or on the back of your debit or credit card.

    The same goes for answering calls from numbers you don’t recognise. However, criminals can now disguise their numbers to look like genuine phone numbers, so be aware of that tactic too.

    2. Don’t give out any personal details
    Your bank will never contact you to ask for any personal information such as your password or your PIN.

    3. Don’t click on any unknown links
    Avoid clicking on unknown links or opening unknown files. The same goes for pop-up windows in your internet browser.

    4. Check if a website is genuine
    To check if a website is real, look for a padlock sign next to the website address. If the site weblink starts with “https” this means the site is secure and protects customer details using encryption.

    5. Don’t be rushed into transferring money
    If someone tries to rush or panic you, alarm bells should ring immediately – a genuine organisation would never rush you to make a decision. Do not transfer any money at this stage. If need be, make an excuse such as your doorbell ringing and use this time to gather your thoughts.

    What to do if you think you may have been scammed
    If you think you may have been scammed, let your bank know immediately so they can try to stop the transfer. Criminals rely on you feeling too embarrassed to tell anyone you were duped, but that’s better than losing money to bank transfer fraud.

    More information from Which? on what to do if you’re a victim of a bank transfer (APP) scam

    Your home may be repossessed if you do not keep up repayments on your mortgage. Loans are subject to status, terms and conditions. This website is for information purposes only. If you are in any doubt regarding suitability of our products please seek advice from an accredited independent mortgage adviser.

    Your eligible deposits with Castle Trust Bank are protected up to a total of £85,000 by the Financial Services Compensation Scheme, the UK’s deposit guarantee scheme. Any deposits you hold above the limit are unlikely to be covered. For further information about the compensation provided by the FSCS, refer to the FSCS website at

    Castle Trust Bank means Castle Trust Capital plc, a company incorporated in England and Wales with company number 07454474 and registered office at 10 Norwich Street, London, EC4A 1BD. Castle Trust Capital plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority, under reference number 541910.

    © 2021 Castle Trust Bank. All rights reserved.