™
Red flags
Five requests that end it.
Fraud borrows real branding, real company numbers and real names. It cannot borrow the register — and it always asks for one of these.
- A full banking password. No genuine message from the group asks for one, in any format, for any reason.
- A one-time passcode. Codes authorise actions on your accounts. Nobody genuine asks you to read one out or forward one.
- A move to a personal chat app. Account matters stay on official channels. WhatsApp, Telegram or a personal number is a warning sign.
- An upfront fee to release money. No genuine facility requires a fee, deposit or "insurance payment" before funds move.
- Payment to newly announced bank details. Treat changed-details messages as fraudulent until confirmed through a route you already hold.
Pressure is part of the design: a deadline measured in minutes, a consequence for checking, a reason the usual route cannot be used. Genuine account problems survive a phone call to a published number.
A genuine group message comes from a domain in the official register, asks for none of the five items above, and survives being verified through credicorp.co.uk or the published phone line.
Thirty seconds
Check the domain before you reply
The register is exhaustive. The check runs in your browser.