Your phone number is not a key to your bank account. It's more like your postal address: it tells a criminal where to send the bait. The two ways it can lead to your money both depend on something extra, and both can be blocked.

Route 1: persuasion

By far the most common route. The scammer calls or texts pretending to be your bank, a delivery firm, HMRC or your mobile network, and gets you to do one of these:

  • read out a one-time passcode your bank just texted you;
  • enter your login details on a fake website;
  • approve a payment in your banking app because "it's a security check";
  • move money to a "safe account".

None of this works without your help. The rule that stops it: a code sent to you is your signature on a payment. Nobody genuine, including your bank, will ask you to read it out on a call.

Route 2: SIM swap or number port

Here the criminal already has some of your personal details, often from a data breach or phishing, and uses them to persuade your mobile network to move your number to a new SIM or another network. Once they control your number, they receive your texts, including bank codes.

Warning signs: your phone suddenly loses signal and shows "SOS only" or "No service" for no obvious reason, or you get a message about a SIM change or a porting request you didn't make. Contact your network immediately from another phone.

How to protect yourself

  1. Add a security password or PIN to your mobile network account, so changes need more than your name and date of birth.
  2. Use your banking app's in-app approvals where available, and keep the app locked with biometrics.
  3. Never share codes sent by text, even with someone who says they're from your bank.
  4. Be careful how widely you publish your number next to your full name and date of birth.
  5. If a call about your account worries you, hang up and dial 159 to reach your bank safely.

If you think it's already happened

Call your bank on 159 or the number on your card, then your mobile network. Report the fraud to Report Fraud, or to Police Scotland on 101. Most victims of authorised push payment scams are entitled to reimbursement, and speed makes a difference.

Scammers often make these calls look like they come from the bank's real number. Our article on caller ID spoofing explains how, and why hanging up and calling back is the defence that always works.