Ilia Zavialov on how a phone scammer talks: a glossary of the call from your bank's security team

Why a phone scammer needs a vocabulary of their own

A call from the bank's security team runs on words. The scammer has no access to the account, no password and no power over the money. There are only a few minutes of conversation in which the caller has to persuade a person to do, with their own hands, whatever opens the way to their funds.

For that a stable set of terms is used. Suspicious transaction, loan application, safe account, fraud department, verification code, investigation. Every word is borrowed from genuine banking practice, which is why it sounds convincing: people have met it before in letters from their bank or in the news.

Ilia Zavialov suggests reading such a call as a text. Once it is clear what each term really means and why the scammer says it, the conversation loses its grip. Panic gives way to recognition: here is the loan story, here is the move to a safe account, here is the request to install an app.

Below are the words heard most often in these calls, with what each one means inside a bank and what it means inside the script of the scam.

Fraud department, compliance team and personal manager

A bank fraud team does exist. It watches for fraudulent transactions, blocks suspicious payments and may phone a customer to check a transaction. Such a call ends with a simple question: did you make this payment. From there the decision stays with the customer, and nobody asks them to do anything with the card.

Compliance sounds even more official. It is the unit that checks where money comes from and reviews large transfers as the law requires. Scammers borrow the name to explain any odd demand: the money has to be checked, the account has to be cleaned, the payment has to go through again.

A personal manager appears in the script when the person starts to doubt. The caller gives a name, a job title, sometimes a branch number. All of it is easy to invent and impossible to verify while you are on the line.

All three stories share one shape: the caller rings you, names the problem and offers the fix. In a real bank the decision stays with the customer, and contact goes through the number printed on the card or shown in the official app.

Spoofed caller ID and calls through messaging apps

A spoofed number means the screen shows a number the real subscriber never dialled. It is done through internet telephony, so a short bank number or a number that looks like a helpline proves nothing on its own.

More and more often the call arrives through a messaging app. The profile has the bank's logo, the name of the support team and even a green tick drawn onto the profile picture. Such a profile takes minutes to set up, and the bank has no control over it.

The scammer may also send a message with a case number, a photo of a staff badge or a screenshot of the bank's supposed internal system. Any of these documents can be forged in an ordinary image editor.

There is one check. Hang up and call the bank yourself on the number on the back of your card or on the official website you opened yourself. If the problem is real, the agent will see it on your profile.

Suspicious transaction and loan application

The first thing a person hears is a threat. Someone is taking out a loan in your name, someone is trying to spend from your card, someone is changing the phone number in your app. The story is built to make it feel that money is disappearing right now and action is needed immediately.

The loan story works especially well because it creates the fear of a debt the person never took. The scammer offers to cancel the application, and cancelling supposedly requires a counter loan or confirming a transaction with a code. In reality this is how a real loan is taken out, and its money then goes to the scammers.

The suspicious transaction story works the same way. The caller names an amount, a city, sometimes a shop. The figures sound specific even though they are invented, and the person starts protecting the money with exactly the steps they are told to take.

A genuine fraud team in this situation blocks the transaction itself, without the customer's help, and offers to reissue the card in a branch or in the app. To block anything the bank needs neither your codes nor your details nor a transfer to another account.

Safe account and holding account

The safe account is the central word of the whole script. The person is told their current account has been compromised and the money must be moved at once to a protected holding account that the bank has supposedly opened for such cases.

No bank offers such a product. The money in your account is protected by the account itself, and to keep it safe the bank never asks you to move it anywhere. The account you are asked to pay into belongs to the scammer or to a money mule, someone who lets others use their card for a fee.

Sometimes the story calls it a transit, technical or insurance account. The word changes and the substance stays: your money is meant to go where nobody will return it.

Any request to move money to another account to protect it should be treated as a sign of fraud, with no exceptions. That is the moment to end the call.

One-time passcode, CVV, PIN and app password

A one-time passcode from a text message or a push notification is meant for the owner only. The bank sends it so that you confirm a login, a payment or a change of settings yourself. When a caller asks you to read it out, it means they are carrying out a transaction in your name right now.

The CVV, the three digits on the back of the card, together with the number and expiry date lets anyone pay online. The PIN unlocks cash at an ATM. The app password gives full access to your accounts. A bank employee needs none of this, because the bank already holds everything it needs to know about your card.

Scammers often ask for just a few digits of the code, or for the message to be read aloud because the security system supposedly sent it. Any part of the code opens the transaction just the same.

It is worth reading the text of the message itself. Banks say what a code is for: logging in, adding the card to a mobile wallet, changing the phone number. That text often contradicts what the caller is saying.

Remote access apps and screen sharing

When a person refuses to read out codes, the scammer offers an easier route. Install this app and our specialist will set everything up. These are remote access tools that system administrators use in other circumstances.

Once installed, the caller sees the screen and can control the phone. They read incoming codes themselves, type amounts into the banking app themselves, and the person only taps the buttons they are told to tap.

Screen sharing on a video call through a messaging app plays a similar role. The person shows what is on the phone so that the caller can supposedly help find the threat, and in doing so shows every message that contains a code.

No bank needs access to your screen to protect your account. A request to install an app or turn on screen sharing ends the call in the same way as a request for a code.

Police, investigators and a confidential case

If the bank story fails, the script continues with a second call. Now the caller claims to be the police, a detective, a prosecutor or a federal agent. They say a bank employee is involved in the theft and ask for help with the investigation.

Confidentiality in this script exists to isolate the person. They are told not to speak to relatives or bank staff, because accomplices are supposedly among them. This cuts off any chance of outside advice.

Law enforcement does not carry out investigations by phone and does not ask the public to transfer money, take out loans or withdraw cash to catch a criminal. Summonses and requests to attend come in writing, and their authenticity can be checked through official channels.

If a call from supposed officers comes right after a conversation about your bank, it is almost certainly the same scheme continuing. The right response is the same: hang up and check the information yourself.

What a genuine bank call sounds like

It helps to know the other side of the picture. A genuine call about a suspicious payment is short and calm. The agent names the transaction, asks whether you made it and, if you did not, tells you the card is being blocked and a new one will follow.

A genuine agent does not mind if you want to hang up and call back through the number on the card. There is no countdown, no talk of your money vanishing in the next ten minutes and no request to keep the call secret from anyone.

Everything after the yes or no question happens on the bank's side. You are not asked to move money, open another account, read out codes or install software. If any of that comes up, the call has moved into the script described in this glossary.

What the UK figures show

UK Finance reports that 1.28 billion pounds was stolen through payment fraud in 2025, 4 percent more than a year earlier. Authorised push payment fraud, in which the victim makes the payment themselves, accounted for 248,070 cases and 576.4 million pounds.

The script this glossary describes has its own line in the statistics. Impersonation of the police or bank staff produced 6,016 cases and 55.5 million pounds in losses in 2025, the lowest figures ever reported for that category, with cases down 23 percent and losses down 18 percent. Every person who already knows these words makes the script harder to run.

66 percent of authorised push payment cases start online, and another 17 percent start through telephone networks. The bank security call belongs to that second group, and it relies on the victim sending the money personally.

Someone in London, Manchester, Birmingham or Glasgow who knows the vocabulary above can end such a call in the first minute, before anything is paid.

Reimbursement rules in the UK

Since 7 October 2024 payment firms have had to reimburse victims of authorised push payment fraud, with a limit of 85,000 pounds per claim. The rule covers exactly the case where a person moves money to a safe account on a caller's instructions.

In the first nine months 88 percent of claimed losses, 112 million pounds, was returned, and 84 percent of claims were settled within five working days. Reporting quickly matters: the sooner the bank hears about the payment, the sooner the claim is handled.

How to end the call and where to report

You can end a call at any moment, and it never harms your account. Tell the caller you will ring back on the number on your card, then call the bank or message it through the official app.

If you have already given a code or installed an app, freeze the card in the app, call the bank, remove the remote access app and change the app password from another device. Ask the bank about reimbursement at once.

Since 4 December 2025 fraud in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040. Keep the number that called you, screenshots of messages and the account details the money went to.

Tell older relatives about the call. The bank security script relies on people hearing it for the first time, and someone who already knows these words recognises the scam from the first sentence.