Fraudsters don’t just ask for your password anymore. They use emails, texts and phone calls that look or sound convincing, pretending to be someone you trust and putting you under pressure to act.
Phishing can happen to anyone. We’ll take you through what it is, some red flags to look out for, how to prevent it, and what you can do if you think you’ve been caught by a scam.
What could phishing look like?
A business owner received an unexpected phone call from someone saying they’re from the Financial Conduct Authority (FCA). The caller said that the business owner’s bank card had been linked to suspicious activity and that they needed to do a security check to protect their account.
The fraudster explained that they needed to verify the business owner’s identity before they could investigate further. The customer was told that a one-time passcode (OTP) would be sent to their mobile phone and that they needed to read it out as part of the identity verification process. Believing they were speaking to a real FCA representative, the customer shared the OTP.
The OTP was being used to register their debit card to a digital wallet on the fraudster's device. Once the card was added, the fraudster made purchases using the digital wallet without needing the physical card. The business owner only became aware of the fraud after noticing a series of unauthorised transactions on their account.
The business lost £9,996.56 across three payments.
What is phishing?
Phishing is when someone uses an email, text, or phone call to trick you into sharing information, clicking a link or making a payment.
These scams often create panic or urgency. A fraudster might claim there’s suspicious activity on your bank account, that your money is at risk or that you need to approve a refund. They could then ask you to share a security code, make a payment or download software.
Phishing scams are common. The UK Government’s 2025/2026 Cyber Security Breaches Survey found of the 43% of UK businesses experienced a cyber security breach or attack in the previous 12 months, phishing was by far the most common type, reported by 38% of businesses.
Red flags to look out for
Unexpected contact from someone claiming to be a trusted organisation should always make you stop and check. Look out for:
- Someone asking for personal or banking details.
- Emails or texts containing unexpected links or attachments.
- Links that don’t match the organisation’s official website.
- Someone asking for your PIN, password, passcode or one-time password.
- Requests to download software or give someone remote access to your device.
- Someone asking you to move money to ‘keep it safe’ or approve a ‘refund’.
- A caller who doesn’t want you to hang up and call back independently.
- Pressure to share information or take immediate action.
Timing can be a red flag too. Fraudsters may deliberately contact you when you’re busy, working alone or less able to check a request with someone else.
If you have been a victim of fraud, contact your bank straight away. The sooner you act, the better the chance of limiting your loss, although there’s no guarantee that money lost to fraud can be recovered.
Stop, check and protect your business
Phishing scams are designed to catch people at the wrong moment. Being busy, stressed or distracted can make it harder to spot something that isn’t right.
One of the simplest things you can do is stop. If someone asks for security details, tells you to move money or wants access to your device, stop, hang up and check independently. A few extra minutes could help protect your business and its money.
Know what to do next
Spotting the signs early is the first step. You can read more about how to protect your business from phishing here:
Worried about fraud?
Visit our Fraud Centre for immediate help and further advice.
