Scam watch: 'I was sent a one-time passcode from my bank'
Faye was Headline Money Consumer Money Journalist of 2023 and a Wincott Award finalist in 2025. She's been investigating scams for nearly a decade.
Dear Which?,
I was called by the fraud team at my bank, Barclays. I wasn’t convinced it was genuine, so I hung up and called the number on the back of my card. It was genuine and £120 had been spent at Sainsbury’s. I was reimbursed and the card was cancelled.
My new card arrived and two days later I received another call claiming to be from Barclays. Because the previous one had been genuine, I thought this one must be too. I was asked if I recognised a £589 Deliveroo transaction – I didn’t.
The caller said the team would cancel it. He said I had received texts asking to confirm other fraudulent transactions with a one-time passcode (OTP). He said I needed to give him the OTPs to cancel the transactions.
I challenged this because the texts said not to share the OTP with anyone. He countered that I knew it was Barclays calling because they had contacted me before. I gave him the OTPs. When another OTP arrived for a payment of over £900, I was suspicious and hung up.
How can I know if a bank call is genuine?
Ian, East Yorkshire
Faye Lipson, Which? senior researcher, says:
This was a sophisticated scam. The fraudster probably had your original card details and phone number all along. They may have obtained the replacement card’s long number via an automatic billing updater – I recently wrote about card fraud after cancelling a card.
Your information may have been stolen in a data breach, or gathered as part of an earlier scam. It’s unfortunate that this initial genuine call primed you for the scam call – and the fraudsters were probably counting on this.
You’ve spoken to Barclays and have agreed some additional security measures to put in place for phone calls.
However, if you receive a call claiming to be from your bank, the safest thing to do is hang up and call 159, which will connect you with your bank. We advise that you do this on a different phone line, or wait at least 15 minutes before you do – just in case the scammer is still connected to the call.
You can also report any scam attempt to reportfraud.police.uk, or by calling the police on 101 if you live in Scotland.
Get in touch. If you've got a scams story to share, email us at yourstory@which.co.uk
Please be aware that we cannot help with or respond to every email that we receive. The inbox is monitored periodically during office hours, Monday-Friday 9am-5pm.
