What to do if…
you shared your bank login or a one-time code and think your account is at risk

What to do now

1. Stop the interaction and use a trusted contact method.
   If you are on a call, chat, or message thread with the “bank”, “fraud team”, “police”, or “security team”, end it. Then contact your bank using one of these routes:

   • your bank’s official app or in-app support
   • the phone number printed on your card or statement
   • 159, if it connects from your phone provider, then choose your bank if it is listed

2. Tell your bank exactly what happened.
   Say: “I shared my online banking login or a one-time passcode. I think my account is at risk.” Ask them to secure the account now.

3. Ask the bank to check and block the account-risk points.
   Ask them to:

   • lock or restrict online and mobile banking if needed
   • block further outgoing payments where possible
   • check for new payees, standing orders, scheduled payments, and recent transfers
   • remove anything you do not recognise
   • check whether your phone number, email address, postal address, security details, or device list were changed
   • tell you what they can stop, cancel, recall, or dispute now

4. Write down the bank’s reference details.
   Ask for a fraud or case reference number. Note the time you contacted the bank, who you spoke to, and what they said they had done.

5. Secure the accounts that could let someone get back in.
   After you have contacted the bank, use another device you trust if you can. Change your online banking password and any memorable information the bank tells you to reset. Check your email account for forwarding rules you did not set up, then change your email password too, because bank password resets and alerts often go through email. Sign out of other sessions or devices where your bank or email account offers that option.

6. Check your banking app or online banking for takeover signs.
   Look for:

   • new payees or beneficiaries
   • payments, transfers, standing orders, or scheduled payments you did not set up
   • new devices or login alerts
   • changes to your contact details
   • messages about security resets or one-time codes
     Tell your bank about anything you do not recognise.

7. Report the fraud through the right UK route.
   If you live in England, Wales, or Northern Ireland, report it through Report Fraud. If you live in Scotland, report it to Police Scotland by calling 101. If you feel in immediate danger or someone is threatening you in person, call 999.

8. Reduce follow-on risk after the bank has secured the account.
   Watch your bank notifications and balance. If you reused the same password anywhere else, change it there too, especially on email, payment apps, shopping accounts, and mobile phone accounts. If you believe identity details were also exposed, consider Cifas Protective Registration, but check the cost and effect first because it can add extra checks to genuine applications.