The Verification Desk

Category: Banking & Payment Scams

  • The One-Time Passcode That Adds Your Card to a Criminal’s Digital Wallet

    VERDICT: STRONGLY VERIFIED (V4)

    A genuine one-time passcode can authorise the wrong thing if you misunderstand what it is asking you to approve.

    CLAIM

    Criminals can use card details entered into a fake shopping or delivery page to begin adding the victim’s card to a digital wallet on the criminal’s device, then trick the victim into supplying the OTP needed to complete wallet setup.

    EVIDENCE

    Which? documented the mechanism in 2025 after work involving Cifas, the Cyber Defence Alliance and UK Finance. Its investigation found that many card providers still offered SMS OTPs as one method of approving cards being added to digital wallets.

    In July 2026 Which? documented a victim who lost more than £18,000 after fraudsters persuaded him to provide an OTP which they used to add his Revolut card to an Apple Pay wallet, followed by fraudulent spending.

    TEST

    The evidence establishes the mechanism and documented victim cases. The public evidence used here is principally consumer and industry investigation rather than a national police prevalence dataset, so TVD does not estimate how many UK victims have experienced this specific technique.

    VERDICT

    V4 — Strongly Verified.

    How to prevent it

    • Read the entire OTP message before entering or sharing the code.
    • If the message says the code is for adding a card to Apple Pay, Google Wallet or another wallet when that is not what you are doing, stop immediately.
    • Never assume a genuine bank OTP means the website that triggered it is genuine.
    • If an unfamiliar wallet has been linked to your card, contact your card issuer immediately.

    Warning signs

    • An OTP message refers to adding your card to a digital wallet when you are only trying to make a purchase or delivery payment.
    • A caller or webpage asks you to enter an OTP without clearly explaining the action it authorises.
    • Your banking app shows a new wallet or device you do not recognise.

    What to do if you responded

    Contact your card issuer immediately, explain that your card may have been added to an unauthorised digital wallet, review recent transactions and ask the issuer to secure the card and linked wallet access.

    Where to report it

    Report unauthorised transactions to your bank or card issuer first, then use the appropriate official fraud-reporting route. See Fraud First Aid.

    Sources: Which? investigations, August 2025 and July 2026, drawing on industry evidence and a documented victim case.

    Evidence boundary: digital-wallet services themselves are legitimate. The fraud involves criminals abusing card-provisioning and social-engineering processes.

  • The Police Caller Who Tells You to Buy Gold

    VERDICT: VERIFIED (V5)

    A supposed police investigation should never require you to buy gold and hand it to a stranger.

    CLAIM

    Courier-fraud offenders are persuading victims to buy high-value gold or jewellery before arranging for a courier to collect it.

    EVIDENCE

    City of London Police, the national lead force for fraud, said in June 2026 that courier-fraud reports increased from 1,721 in 2024 to 1,891 in 2025. Total losses rose from £19.5 million to more than £21 million.

    Police identified a growing 2025 trend involving jewellery and gold. Victims can be persuaded to visit multiple jewellers, buy expensive items and later hand them to a courier. Police say courier fraud typically starts with an unexpected call from someone claiming to be a police officer or bank employee.

    TEST

    The £21 million figure covers courier fraud as a whole. It is not a loss figure for the gold-and-jewellery variant alone.

    VERDICT

    V5 — Verified.

    How to prevent it

    • Police and banks will not ask you to buy gold or jewellery for an investigation.
    • They will not send a courier to collect your cash, cards, PINs or valuables.
    • End the call and independently contact the organisation using a number you know is genuine.
    • If a caller is keeping you on the phone while directing purchases or travel, treat that as an immediate warning sign.

    Warning signs

    • A supposed police officer or bank employee asks you to buy gold, jewellery or other valuables.
    • You are told a courier will collect cash, cards or valuables.
    • The caller tells you to keep the operation secret or remain on the phone while you travel or make purchases.

    What to do if you responded

    Do not hand anything to a courier. If a collection has already happened, contact police and your bank promptly and preserve receipts, CCTV, caller details and descriptions of the courier or vehicle.

    Where to report it

    Contact police if a collection is imminent or has just occurred. Report the fraud through the appropriate official route and contact your bank if financial information or cards were disclosed. See Fraud First Aid.

    Source: City of London Police / Report Fraud, 15 June 2026.

  • The Marketplace Buyer Shows You a Payment Screen. The Money Still May Not Exist

    VERDICT: STRONGLY VERIFIED (V4)

    Meeting a buyer face to face does not make an electronic payment real.

    CLAIM

    Marketplace sellers have handed over high-value goods after buyers presented false payment information or claimed a transfer had completed when the seller had not actually received the money.

    EVIDENCE

    Avon and Somerset Police reported in August 2026 that a seller who had advertised computer equipment on Facebook Marketplace met a buyer who provided false payment details and claimed the transaction had completed. The seller handed over a graphics card, mobile phone and laptop, but no money had been received. Police said their enquiries indicated two similar offences the previous day using the same method.

    Northamptonshire Police separately reported an investigation involving a PlayStation 5 advertised on Facebook Marketplace where the victim later discovered the agreed payment had not been received.

    TEST

    The police evidence establishes false-payment Marketplace handovers. These sources do not by themselves establish that a particular fake banking application was used in every case. TVD therefore does not make that narrower claim here.

    VERDICT

    V4 — Strongly Verified. The false-payment handover mechanism is established by separate police investigations; the exact technical method remains unproven in these cases.

    How to prevent it

    • Check your own banking app or account before releasing goods.
    • Do not rely on a buyer’s screenshot, phone display or payment confirmation.
    • If your own account does not show cleared funds, treat the item as unpaid.
    • For valuable goods, keep the marketplace conversation and transaction evidence.

    Warning signs

    • The buyer shows you their own payment screen instead of waiting for your account to show the money.
    • You are told a bank transfer is complete but delayed.
    • The buyer pressures you to release high-value goods before cleared funds appear in your account.

    What to do if you responded

    If the goods have gone and the money has not arrived, preserve the marketplace conversation, buyer profile, collection details, vehicle information, CCTV or doorbell footage and any payment screenshots. Report the account to the platform and contact police through the appropriate route.

    Where to report it

    Report the marketplace account to the platform and report suspected fraud through the appropriate official route. See Fraud First Aid for evidence-preservation steps.

    Sources: Avon and Somerset Police, 8 August 2026; Northamptonshire Police, 13 August 2026.

  • The Survey Call That Can Steal Your Voice

    VERDICT: VERIFIED (V5)

    A harmless-sounding survey call can now be part of something much more serious.

    CLAIM

    Criminals are using telephone “lifestyle surveys” to collect personal information and voice samples, then using AI-generated voice clones to simulate consent for unauthorised Direct Debits.

    EVIDENCE

    On 5 February 2026, National Trading Standards (NTS) warned that an organised criminal operation was using apparently innocuous lifestyle-survey calls to collect personal, health and financial information. NTS said criminals were using the information to develop AI-generated voice clones that could simulate consent for Direct Debits and deceive legitimate businesses and financial providers.

    NTS reporting also describes work with a major Direct Debit provider across 175 postcode areas where chronic victims were identified using AI technology. Those victims were losing an average of £600 a month; cancellation of Direct Debits produced estimated savings of £485,100.

    TEST

    This is not simply a prediction that voice cloning could be used for fraud. NTS describes an operational intervention involving victims, Direct Debits and AI technology. That supports the existence of the technique. It does not establish how common this specific method is across the whole UK.

    VERDICT

    V5 — Verified. The specific technique is supported by National Trading Standards evidence. National prevalence remains unknown.

    How to prevent it

    • Treat unsolicited lifestyle surveys as requests for personal data, even when no payment is requested.
    • Do not provide banking or detailed financial information during an unsolicited survey call.
    • Review Direct Debits regularly and challenge anything you do not recognise with your bank.
    • If you think you have been targeted, preserve the caller number, time and any messages before reporting it.

    Warning signs

    • An unsolicited “lifestyle” or consumer survey asks for unusually detailed personal, health or financial information.
    • The caller encourages long spoken answers or asks you to repeat phrases.
    • A survey that appeared harmless moves towards banking information.

    What to do if you responded

    Review your bank account and Direct Debits, contact your bank through a trusted route about anything you do not recognise, and secure any accounts whose details you disclosed. Keep the caller number, date, time and any messages.

    Where to report it

    If money has been lost, contact your bank first. In Northern Ireland, England and Wales, fraud can be reported through Report Fraud; in Scotland, contact Police Scotland. Suspicious calls and messages can also be reported through the relevant telecoms or cyber-reporting channels. See Fraud First Aid for the immediate response sequence.

    Source: National Trading Standards, “Phone scams take sinister twist as victims’ voices cloned”, 5 February 2026; National Trading Standards annual reporting.

    Evidence boundary: TVD has verified that NTS documented this technique. We are not claiming that every lifestyle-survey call is fraudulent or that NTS has quantified the total number of UK victims of this specific method.

  • The Bank-Detail Change Verification Test

    The Bank-Detail Change Verification Test

    A request to change supplier bank details may be genuine. The email containing it proves almost nothing.

    CLAIM

    A bank-detail change should be treated as a change to a control, not an ordinary administrative instruction.

    EVIDENCE

    Compromised email accounts and convincing impersonation can place a fraudulent instruction inside a genuine conversation. Familiar wording, a correct signature block and knowledge of an invoice do not establish that the payment destination is legitimate.

    TEST

    The decisive test is independent confirmation through a channel already trusted before the change request arrived.

    VERDICT

    No independent confirmation, no change. Urgency is a reason to slow the process down, not bypass it.

    ACTION: THE BANK-DETAIL CHANGE TEST

    1. Freeze the change. Do not amend the supplier record or release payment.
    2. Use a pre-existing contact. Call a known contact using a number from the existing contract, verified supplier master record or official website, not the message requesting the change.
    3. Ask open questions. Confirm the change, effective date, reason and account name without reading every detail from the request.
    4. Require dual approval. One person verifies; another approves the amendment.
    5. Record the verification. Date, time, person contacted, number used, questions asked and outcome.
    6. Notify the known contact. Send confirmation to the previously established address as well as any new address.
    7. Control the first payment. For material changes, consider an independently approved test payment or enhanced review under the organisation’s policy.

    RED FLAGS

    • Pressure to act before a deadline
    • A request to avoid the usual contact
    • A new domain, subtle spelling variation or reply-to address
    • An explanation involving an audit, frozen account or confidential transaction
    • A simultaneous change to contact and bank details
    • Resistance to established verification controls

    IF PAYMENT HAS ALREADY BEEN MADE

    Contact the bank immediately through a trusted channel. Preserve the request, full email headers, invoice, payment approval, supplier record and every verification attempt. Contact the genuine supplier using established details.

    CONTROL TEMPLATE

    Change requested: ______
    Existing trusted contact: ______
    Independent number/source: ______
    Confirmed by: ______
    Verified by: ______
    Approved by: ______
    Date/time: ______
    First-payment control: ______

    Evidence & official sources

    The Verification Desk distinguishes verified fact, evidence-led inference and unresolved uncertainty. This publication provides general information, not legal, financial, regulatory or emergency advice. Findings reflect the evidence available at publication and may be updated if material evidence changes.