Overview
- Criminals pose as bank anti-fraud teams, initiating contact by phone or text and directing targets to fake websites with a chat function that installs remote-access malware.
- The malicious software enables full control of victims’ devices and online banking, with fraudsters extracting one-time passcodes to move money and set up new payees.
- Losses have reached tens of thousands of pounds and, in some cases, exceeded £1 million, with businesses, charities and other high-value account holders targeted.
- Some victims are convinced to activate call diversion, preventing legitimate bank staff from reaching them during attempted thefts.
- Cifas and UK Finance advise customers to use verified contact numbers or the 159 service, never install software or share authentication codes, forward suspicious texts to 7726, and report incidents to their bank and the police.