Fake bank texts about a new direct debit: don't ring the number to cancel it

What's happened

Fraudsters are sending texts that look like they come from your bank, saying a new direct debit or standing order has just been set up on your account. The message gives a phone number to call "if this wasn't you". Ring it and you're through to a scammer, not your bank.

Which? has flagged several waves of these texts this year. On 21 September it warned about a fake Barclays text saying "a direct debit has been set up on your account", with a number to call to cancel it. On 26 August it was a Nationwide text about a new standing order, and in May and June there were more fake Barclays texts, one claiming a £1,500 credit card application had been approved. Each one came from a spoofed number, and each callback number led to a fraudster after personal and financial details.

It comes as Citizens Advice runs its Scams Awareness campaign, from 12 to 25 October. UK Finance says impersonation scams, where criminals pose as a bank, the police or another organisation and persuade people to move money to a "safe account", fell in 2025, with losses down 12% and cases down 11%. But authorised push payment (APP) fraud overall rose 19% to £576.4 million, across 248,070 cases.

The warning signs

• A payment you don't recognise and a number to ring. Getting you to ring them makes you feel you started the conversation.
• The person on the phone says your account is at risk. They may claim to be the fraud team.
• They ask for a code, PIN or password, or ask you to read out a one-time passcode sent to your phone.
• They tell you to move money to a "safe account" or to keep the call secret from bank staff. Your bank will never do this.
• Pressure to act now before the payment "goes out".

What it could cost: a worked example

This is an illustration, not a real case. Say you get a text claiming a £49.99 direct debit has been set up, call the number and are talked into moving £4,000 of savings into a "safe account" that the scammer controls.

Because you sent the money yourself, it counts as APP fraud. Under the Payment Systems Regulator's rules, your bank must refund losses of up to £85,000 per claim, unless you were complicit or "grossly negligent", which the PSR calls "a high bar". The bank can take off an excess of up to £100, so you'd get at least £3,900 back. It can't apply the excess if you're a vulnerable customer.

The refund is due within five business days of your claim. Your bank can pause the clock to ask questions, but it must decide within 35 business days. You have 13 months to report it, but act fast, as the bank may be able to freeze the money.

If the scammer moves money without you, using details you gave them, that's an unauthorised payment under separate rules, and your bank should generally refund it.

How to check if something is genuine

• Don't use the number in the text. Log in to your banking app or call the number on the back of your card.
• Check your direct debits yourself. Most banking apps list every direct debit and standing order.
• Call 159. This free number connects you to your bank's fraud team from most UK banks, so you know you're talking to the real thing.
• If someone calls you, hang up and ring back on a number you trust, ideally from another phone.
• Remember the Direct Debit Guarantee. If a genuine direct debit is taken wrongly, you're entitled to a full and immediate refund from your bank, so there's never a need to rush.

What to do if you've been caught

1. Call your bank immediately on 159 or the number on your card. Tell it you've been scammed and ask it to stop or recover any payments.
2. Forward the scam text to 7726 (it spells SPAM on a keypad). It's free.
3. Forward any scam emails to [email protected], the National Cyber Security Centre's reporting service.
4. Report it to Report Fraud online or on 0300 123 2040. In Scotland, call Police Scotland on 101.
5. Change your passwords and PINs if you shared any, starting with online banking and your email.
6. Claim a refund from your bank. If it says no, complain, then go to the Financial Ombudsman Service, which can also look at losses above £85,000.

Your questions answered

The text appeared in the same thread as real messages from my bank. Isn't that proof it's real?

No. Scammers spoof the sender name, so their text can slot in next to genuine ones. Which? says these texts came from spoofed numbers.

I called the number but didn't hand over any money. Am I safe?

Not necessarily. If you gave out personal details, passwords or a one-time code, call your bank on 159 straight away and change your passwords. Expect follow-up calls.

Will I definitely get my money back?

Most people should. The PSR's rules cover payments up to £85,000, minus an excess of up to £100. UK Finance says banks reimbursed £354.3 million of APP fraud losses in 2025, or 61%, while the PSR says 89% of losses covered by its rules were refunded in the first 15 months.

Sources: Which?, UK Finance, Payment Systems Regulator, Citizens Advice