Impersonation scams work because the caller borrows the authority of someone you are trained to trust, such as your bank, the police, a tax office or your energy supplier, and then uses that authority to rush you into paying or handing over details. The script changes every few months (a missed jury summons, a phone number "used in crime", a tax rebate, an account "under attack"), but the shape stays the same: unexpected contact, a threat or an urgent problem, secrecy, and a demand to move money in an unusual way. This guide breaks down the main impersonation scripts used in the UK and the US, the single habit that defeats almost all of them, and how organisations and families can make that habit stick. It is for individuals, people helping older or vulnerable relatives, and the staff who run awareness programmes. For how phone and text attacks work against organisations, see the Vishing and Smishing Guide.
Key takeaways
- Hang up and call back on a number you already trust. In the UK, 159 connects you to most banks and, according to Stop Scams UK, cannot be spoofed. Everywhere else, use the number on your card, statement or the official website you type in yourself.
- Real authorities do not take payment over the phone in gift cards, crypto or payment apps. The FTC says courts and government agencies do not take payment over the phone, and that demands for payment apps, cryptocurrency, gift cards or wire transfers are a sign of a scam.
- No genuine bank or police officer asks you to move money to a "safe account". The safe account story is the main entry point for authorised push payment fraud in the UK.
- Secrecy is a red flag in itself. The FTC notes that a real FTC employee will never tell you to keep a conversation secret; the same is true of banks and police.
- Caller ID and personal details prove nothing. Scammers spoof numbers and already know names and addresses from leaks and social media.
The anatomy of an impersonation call
Most impersonation scams follow five moves. Recognising the move matters more than recognising the story, because the story is designed to change.
| Move | What the scammer does | Why it works | What breaks it |
|---|---|---|---|
| 1. Borrowed authority | Claims to be a bank fraud team, police officer, US Marshal, tax official or energy supplier; may read out a badge number or text a photo of an ID card | People are taught to cooperate with these bodies | Knowing that ID numbers and photos are trivial to fake |
| 2. Proof by detail | Quotes your name, address, last digits of your card or a real recent purchase; the caller ID may show the real organisation's number | Details feel like proof of legitimacy | Knowing that personal data leaks and caller ID is spoofed |
| 3. Urgency or threat | Your money is being stolen right now, you will be arrested, your number will be disconnected, the power will be cut off today | Fear shuts down careful thinking | A rule that no real problem needs to be fixed in this call |
| 4. Isolation | Tells you to keep the call secret, not to tell bank staff, or stay on the line; transfers you to a second "officer" to confirm the story | Stops anyone else spotting the scam | Telling someone, and treating secrecy requests as proof of fraud |
| 5. Unusual payment | Asks you to transfer to a new account, buy gift cards, pay by crypto or payment app, hand cash or cards to a courier, or install remote access software | These methods are fast and hard to reverse | Knowing that real organisations do not ask for these |
The FTC's October 2026 alert about callers posing as FTC officials shows every move in one script: a fake badge ID, a claim that your phone number is being used for crime abroad, a threat to deactivate the number, a transfer to a fake police officer, an instruction to keep the call secret and finally a demand for a "security deposit". One detail is worth knowing: if the victim hesitates, the scammer may tell them to look up a police number online and call it, and the scammers answer that line. Verification only works when you choose the number from a source you trust.
The main scripts and how to spot them
| Who they claim to be | Typical script | What the real organisation does not do |
|---|---|---|
| Your bank's fraud team | "Your account has been compromised; move your money to a safe account we have set up", or "read me the code we just sent to confirm it is you" | Ask you to move money to protect it, or ask for one-time passcodes, PINs or full passwords |
| Police (UK courier fraud) | "We are investigating staff at your bank; withdraw cash or hand your card to a courier as evidence" | Collect cash, cards or valuables, or ask you to help with an investigation by withdrawing money |
| Police, US Marshals or courts (US jury duty) | "You missed jury duty and a warrant has been issued; pay the fine now to avoid arrest", followed by a fake warrant by text or email | Send arrest warrants by text or email, call to threaten arrest, or take payment over the phone (FTC) |
| Government regulators (for example the FTC) | "A phone registered in your name is being used for scams; we will deactivate it unless you cooperate" | Ask for money, threaten to disconnect your phone, tell you to keep the call secret, or text a photo of an ID (FTC) |
| Tax authorities (HMRC, IRS) | "You are owed a tax rebate", or "you owe tax and will be arrested", or "your National Insurance number has been used in fraud" | HMRC does not send tax rebate notifications by text or offer rebates on social media (GOV.UK) |
| Energy, water or telecoms supplier | "Your supply will be cut off within the hour unless you pay now", or "you are due a refund; confirm your card" | Demand immediate payment by gift card, crypto or payment app |
| A company you pay bills to, through search ads | A fake bill-payment site appears in paid search results | The FTC's August 2026 alert warns that some paid ads lead to impersonators; type the address you know instead |
| Tech support or your broadband provider | "Your computer is infected; let us connect to fix it" | Call unprompted to ask for remote access. See the Recognising Tech Support Scams Guide |
Safe account scams in detail
The safe account script is worth understanding step by step because it is how many UK victims lose their savings. The caller says they are from the bank's fraud team (or sometimes the police or the regulator), that criminals are draining your account, and that the only way to protect your money is to move it to a new account in your name that they have set up. They often coach you on what to tell bank staff if the payment is questioned, such as saying it is for a family member or a building job. Because you authorise the payment yourself, this is authorised push payment (APP) fraud. The UK Payment Systems Regulator's reimbursement rules cover APP scams paid by Faster Payments or CHAPS between UK accounts, with costs split between the sending and receiving firms and most victims due to be reimbursed within five business days. See the Authorised Push Payment (APP) Fraud Guide for the rules in full.
The one habit: stop, hang up, call back
The UK's Take Five campaign reduces the defence to three words: Stop (take a moment before giving money or information), Challenge (could it be fake? you can refuse, reject or ignore any request) and Protect (contact your bank straight away if you think you have been scammed). In practice, that means one habit.
- End the contact: hang up, close the message, or tell the person at the door you will contact the organisation yourself. A genuine caller will not mind.
- Do not use anything they gave you: no number they read out, no link in the text, no "police number" they told you to look up. All of these can lead back to the scammers.
- Choose a trusted route: in the UK, call 159 to reach your bank; Stop Scams UK says it connects customers of more than 99% of UK retail bank current accounts, including Barclays, HSBC, Lloyds, Monzo, Nationwide, NatWest, Santander and Starling. Otherwise use the number on the back of your card, on a statement or bill, or on the official website you type in yourself.
- Use a different phone if you can: some scammers stay on the line after you hang up a landline, so the next call you make goes back to them. Calling back from a mobile, or waiting a few minutes, avoids this.
- Tell someone: a quick call to a family member, friend or colleague breaks the isolation the scam relies on.
Phrases that should end the call
- "Move your money to keep it safe." Your bank will never ask this.
- "Do not tell the bank staff why you are making this payment." Anyone coaching you to mislead your own bank is a criminal.
- "Read me the code we just sent you." One-time codes are for you to type into the real app or site, never to read to a caller.
- "Pay by gift card, crypto or a payment app." The FTC lists these as a sign of a scam.
- "A courier will collect your card." Neither banks nor police send couriers for cards, cash or valuables.
- "Download this app so I can help." Remote access software gives the caller control of your device and your banking.
Reporting impersonation attempts
Reporting helps even if you did not lose money: the NCSC says reports help it investigate and take down scam email addresses and websites. Where to report:
| What happened | UK | US |
|---|---|---|
| You lost money or shared bank details | Call your bank on 159 or the number on your card first; then report to the police at reportfraud.police.uk or on 0300 123 2040 (Report Fraud, which replaced Action Fraud) | Contact your bank or card issuer; report at ReportFraud.ftc.gov and, for internet-enabled crime, to the FBI's IC3 at ic3.gov |
| Scam text message | Forward to 7726 (free on most networks) | Report at ReportFraud.ftc.gov; forwarding to 7726 also works on major US carriers |
| Scam email | Forward to [email protected] | Report at ReportFraud.ftc.gov |
| Fake HMRC contact | Emails to [email protected]; texts to 60599; calls through GOV.UK's "Report a suspicious HMRC phone call" service | Not applicable (for the IRS, use the IRS's own reporting routes) |
| Fake government or business caller with no loss | Report Fraud online | ReportFraud.ftc.gov |
If you have already paid, act within minutes, not days: banks have the best chance of stopping or recovering a payment when they are told straight away. See the What to Do If You Have Been Scammed Guide for the full first-response sequence.
Helping relatives, customers and staff
Impersonation scams target people who are trusting, busy or alone. A few structural steps protect them better than a one-off warning.
- Agree a family rule: nobody in the family moves money, buys gift cards or hands over a card because of a phone call, without first ringing a named family member. The rule removes the need to judge each story. See the Cybersecurity for Seniors Guide.
- Put 159 and trusted numbers on the fridge: written numbers beat remembered ones under pressure.
- Use bank tools: many banks offer payment limits, delays on new payees and a trusted contact who is alerted to unusual activity. Ask the bank what is available.
- Train staff on the same pattern: callers impersonating IT support, suppliers or executives use the identical five moves against employees. See the Vishing and Help Desk Social Engineering Awareness Guide.
- If you run a customer-facing organisation: tell customers clearly and repeatedly what you will never ask for, publish your genuine contact routes, and make it easy to call back. HMRC's published list of genuine contacts is a good model.
Choosing how to protect someone
| Situation | Best first step | Trade-off |
|---|---|---|
| Confident adult, occasional target | Teach the hang-up-and-call-back habit and 159 | Relies on the habit under stress |
| Older or isolated relative, frequent calls | Family call-first rule, call blocking on the landline, bank trusted contact | Some loss of independence; agree it together |
| Person already scammed once | All of the above, plus warnings about recovery scams | Victims are often targeted again with "we can get your money back" calls |
| Small business owner or finance staff | Written rule: no payment or bank detail change on the strength of a call or email alone | Slows urgent payments slightly |
Measuring whether awareness is working
For organisations running awareness programmes (banks, employers, housing associations, community groups), measure behaviour rather than attendance:
- Call-back rate: in staff exercises, the share of people who end a simulated impersonation call and verify through a known number.
- Reporting volume and speed: the number of suspected impersonation attempts reported, and the time from contact to report.
- Losses prevented: for banks, the share of attempted safe account payments stopped by intervention questions.
- Repeat victimisation: the share of past victims targeted again, and how many of those lose money a second time.
- Customer recall: in surveys, whether customers can name what the organisation will never ask for.
Common failure patterns
- Trusting caller ID: the number on screen matches the bank, so the victim relaxes. Caller ID can be spoofed; only a call you place yourself is trustworthy.
- Verifying with the scammer's own number: the caller offers a number to "check" or tells the victim to search for one. The FTC's October 2026 alert describes exactly this.
- Being coached to mislead the bank: victims follow instructions to give a false reason for the payment, which defeats the bank's intervention.
- Reading out one-time codes: the code was for a payment or a new device login the scammer was making at the same time.
- Staying silent out of embarrassment: delay reduces the chance of stopping the payment. Banks and police see these scams every day.
- Training the story, not the pattern: warnings about last year's script do not help when the script changes. Teach the five moves and the call-back habit.
Framework mapping
| Control area | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|
| Awareness training on impersonation patterns | PR.AT-01 (awareness and training for all personnel) | T1566.004 Spearphishing Voice |
| Extra training for finance, help desk and customer service | PR.AT-02 (specialised roles) | T1566.004 Spearphishing Voice |
| Out-of-band verification before payments or credential resets | PR.AA-03 (users authenticated) | T1078 Valid Accounts (what a successful call often yields) |
| Reporting and escalation routes | RS.MA-02 (incident reports triaged); RS.CO-02 (stakeholders notified) | Not applicable |
Practitioner checklist
- Adopt one rule: end any unexpected call about money and call back on a number you chose yourself.
- Save 159 (UK) and your bank's card number where you and your family can find them.
- Never move money to a "safe account", hand cards or cash to a courier, or read out a one-time code.
- Treat requests for secrecy, gift cards, crypto, payment apps or remote access as proof of a scam.
- Agree a call-first rule with older or vulnerable relatives and ask their bank about payment limits.
- Report texts to 7726, emails to [email protected] (UK) or ReportFraud.ftc.gov (US), and losses to your bank first.
- Warn anyone who has been scammed to expect recovery scam calls.
- In organisations, train the five moves of impersonation, and measure call-back and reporting rates.
Standards and references
- US Federal Trade Commission: The FTC is not calling to deactivate your phone number
- US Federal Trade Commission: Ignore calls, texts and emails threatening to arrest you for missing jury duty
- Stop Scams UK: 159
- Take Five to Stop Fraud: Stop, Challenge, Protect
- Payment Systems Regulator: APP scams
- HM Revenue and Customs: Report suspicious HMRC emails, text messages and phone calls
- National Cyber Security Centre: Phishing scams
- Citizens Advice: Check if something might be a scam
Related NHI Mgmt Group resources: Vishing and Smishing Guide · Authorised Push Payment (APP) Fraud Guide · Cybersecurity for Seniors Guide · What to Do If You Have Been Scammed Guide · Spotting Deepfake Scams Guide