PanicStation.org
UK USA
uk Money & financial emergencies

What to do if…
your card issuer flags a purchase as suspicious and demands immediate identity checks

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

End any unexpected contact and verify it is really your card issuer by contacting them through a trusted route, such as the number on the back of your card or the official banking app. Do not share one-time passcodes or approve prompts you did not start.

Do not do these things

  • Don’t stay on an incoming call just because it sounds convincing or urgent.
  • Don’t read out a one-time passcode, app code, card-reader code, or full security answer to anyone.
  • Don’t approve a banking app prompt unless you started the action yourself.
  • Don’t click a link in a text or email to “verify now” unless you have independently confirmed it is genuine.
  • Don’t send photos or scans of ID, or a selfie, by email, text, or messaging app because someone asked unexpectedly.
  • Don’t install remote-access or screen-sharing software for anyone claiming to be from your bank or card issuer.
  • Don’t share your full PIN, online banking password, or full card details.
  • Don’t move money to a “safe account” or hand over cards or cash because of this message or call.
  • Don’t assume the phone number shown is real; caller ID can be spoofed.

What to do now

  1. Stop the unexpected contact. If this is a call, say you will call back and end it. If it is a text or email, don’t reply, tap links, or open attachments.
  2. Contact your issuer through a trusted route. Use the number on the back of your card, the contact option inside your official banking app, or a branch if that is available to you.
  3. Use 159 if the contact was a suspicious bank call. Hang up first, then dial 159 yourself. If 159 does not connect you to your bank or card issuer, use the number on your card or the official app instead.
  4. Ask what has actually happened. Ask whether there is a flagged or declined transaction, whether your card has been blocked or frozen, what identity check is needed, and what they will not ask you to share.
  5. Complete identity checks only through a channel you opened yourself. If documents are needed, ask whether you can upload them in the banking app, a secure portal you reached from the official website, or in branch if your provider offers that.
  6. Lock the card while you verify, if you can do this safely in the app. Use the official app’s freeze or lock function if available, then ask the issuer whether they need to replace the card or card number.
  7. Treat unexpected codes or prompts as a red flag. If you received a passcode or app approval prompt you were not expecting, do not approve it. Tell the issuer you received it and ask whether someone is trying to log in, make a payment, or add your card to a digital wallet.
  8. Check recent card and account activity. Look for payments, refunds, wallet additions, cash withdrawals, or address changes you do not recognise. If anything looks unauthorised, report it during the verified contact and ask what happens next.
  9. Make quick reports if it looks like a scam attempt.
    • Forward suspicious texts to 7726.
    • Forward suspicious emails to report@phishing.gov.uk.
    • If you are in England, Wales, or Northern Ireland and want to report fraud or cyber crime, use Report Fraud online or call 0300 123 2040.
    • If you are in Scotland, report fraud to Police Scotland by calling 101.

What can wait

  • You don’t need to decide right now whether it is definitely fraud or definitely genuine; first move the conversation onto a trusted channel.
  • You don’t need to write a full timeline immediately. Just note the time, what they asked for, any reference numbers, and whether you shared anything.
  • You don’t need to contact the merchant unless your issuer tells you that is needed.
  • You don’t need to decide about a complaint, refund request, or credit-file check in the first few minutes unless money has already gone or your issuer advises it.

Important reassurance

Fraud flags and extra checks can happen when card systems spot something unusual. Feeling rushed or unsettled is normal; slowing down, ending unexpected contact, and calling back safely is the protective step.

Scope note

These are first steps only to reduce harm and avoid irreversible mistakes. If there are unauthorised transactions, shared security details, or signs of identity misuse, later decisions may need specialist help from your issuer or another appropriate support service.

Important note

This is general information, not legal, financial, professional, or security advice. Processes vary by card issuer, bank, account type, and what has happened. If anything feels off, end contact and use the number on your card or your official banking app.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us