/ Scams

Scam alert: fake Barclays ‘unusual payee request’ text

We’ve been made aware of a scam text message targeting Barclays customers by directing them to a fake website. Here’s what you need to look out for.

Fake text messages posing as banks are nothing new – last year we saw a huge rise in the number of people reporting that they’ve received one purporting to be from Halifax.

But this one using Barclays to target victims features another twist to be wary of: it’s managed to successfully drop into people’s inboxes with the sender set as the bank itself:

These types of ‘smishing’ attempts work by rushing people into visiting a fake website, which can go on to request and steal sensitive information, such as bank details. In this case, its victims will alarmed to read that an ‘unusual payee request’ has been ‘flagged’ on their account.

Fortunately some web browsers, such as Chrome in the below example, will warn you that the site is illegitimate:

However, there’s no guarantee that everyone will receive a similar warning, and some may believe these convincing phishing sites to be genuine.

Spotting and reporting smishing scams

After reporting the fake text to the National Cyber Security Centre (report@phishing.gov.uk), we made Barclays aware of the text. It told us:

“We work closely with the telecommunications industry to support them on preventative measures. We have been, and continue to be, part of an ongoing industry-wide trial to combat ‘smishing’ activity.

The SMS SenderID Protection Registry allows businesses using SMS to register and protect the message headers used when sending text messages to their customers. Over the last two years, the working group has seen a significant drop in fraudulent messages being sent to UK consumers of participating merchants.

We urge customers to pay close attention to the warnings we provide when making payments as these are designed to help protect them against fraud and scams”

Barclays also said that it will never send a text and ask you to click on a link.

If you think you may have handed over your card details to scammers, you should let your bank know what’s happened immediately.

Guide: How to get your money back after a scam

If you’re not sure if contact from a bank is genuine, get in touch with it directly via its official channels to verify the correspondence before you take any action.

Have you received this fake Barclays text or others purporting to be from different banks? Let us know in the comments, and help spread the word to warn friends and family.

Comments
Robert Maitland says:
13 February 2021

Had a phone call to my mobile. Prerecorded message saying my NI number had been used in a fraudulent activity and suggested that I should press “1” to stop this activity. I just deleted the call. Nothing since.

Gizela Rosler says:
13 February 2021

On 28/01/2021 4:42pm I recived this text message : Lloyds: A new payee has been set up on your account on 28/01 at 16:32PM. If you do NOT recognize this please visit: https//lloyds-reviewmobile.com/uk. Tell number +44 7826 682118.
On 05/02/2012 at 10:08am a similar text asking to visit : https://lloyds-signin1.com/uk
Tel nr +44 7867 983954.
I ignored. Don’t have anLloyds account.
Also 19/01/2021 -1:57pm 02: Unfortunately your payment method could not be verified. Please go and update to avoid suspensio via: https://o2.verifypaymentmethod.org
Tel +44 7377 827382
[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

I have had email and text messages from Royal Mail as well as from other carriers all advising unable to deliver parcel and to contact. This seems to occur when I have had a recent delivery so presumably my details have been obtained through the carriers.
Also a very strict sounding gentleman keeps advising me that British Telecom will be cutting off my internet connection within the next 12 hours. Then we were receiving Council Tax refunds – oh yes and I was being taken to Court for tax evasion plus my Amazon Prime account is being debited with some odd amount.
You just feel one day they will catch you out!

I get exactly the same messages as well as from British Telecomms saying my internet and phone line will be cut off if I do not speak to one of their operators — yea right, just scammers, as you say at some time one can be caught out, but so far I have spotted the scams. Once they ask me for an account number, who I bank with, date of birth etc., etc., all these are scams, they only need a very small amount of information to access any ones bank account.

Philip J. Wilson

There is a wonderful variant on the ISP cut off communication. It starts with calming music that fades to allow a calm, female voice to deliver the message that your Internet link is about to be cut off. The whole thing is so innocuous that I burst into laughter when I heard it. Not the reaction that the scammers were seeking to achieve!

We can have as many as 5 calls a day, most are are “Amazon Prime”. As a result I would not have an account with Amazon Prime if they were the last company on earth! It doesn’t do their reputation any good, what are they doing about it?

Do banks ever send genuine text messages to their customers’ phones? I have never received one [my bank might not even have my mobile number – any calls come on the landline, and I don’t use the mobile to call the bank so they cannot capture the number that way].

When I use online banking I immediately get a passcode that is needed to complete the login process when accessing my accounts. I had already provided my mobile number in the hope that I would be alerted to suspicious activity or another problem, but thankfully that has not happened.

I have the same system with Halifax. They text you a code to enter on the sign in page and ask you to trust the device you are on and the code changes every time. I use C Cleaner which clears all my browsing history etc every day so a fresh code is needed every time I log in to anything.

The six digit passcodes sent out by my bank expire within 20 minutes and can be used only once. That should mean that old passcodes are of no value to anyone who managed to see the messages.

John, I expect it depends what phone number you have registered with your bank and asked them to use. One of my banks that I use rarely sent me a text that I had gone slightly overdrawn, but with no link. A useful reminder to top up the account.

I expect I gave Nationwide only the landline number when we changed our address.

I use a card-reading device with my debit card that generates a one-time eight-digit code for on-line banking. I wouldn’t use a phone for on-line banking so I don’t need to have the card reader with me when I am out of the house but, if it is necessary to check a balance or make a payment, there is also the option of logging-in with a one-time code sent by text to the phone.

My main credit card issuer uses the mobile number when necessary to authorise an on-line order to a new payee or for a higher than usual amount.

Deborah Christie says:
14 February 2021

Yes they do. I am with Barclays and have had genuine text messages from them

Karina Cliff says:
13 February 2021

As far as I am aware, Banks do not send texts or emails and that has been iterated again and again.
My mother was contacted by ( apparently) HMRC to claim that her name had come up in connection with a fraud and to provide details of bank account etc. Did not give out any details, not even name but told the person to take a long walk of a very short plank!
Contacted HMRC who said if there had been anything amiss they would have written to her and there is nothing out of order. How many times do people need to be told not to give out details over the phone or click on links from e-mails purporting to be from banks etc? My mother is a nonagenarian and she has more sense than many people half her age when it comes to pishing / smishing/scamming

Banks do send both texts and emails but never include a link to click on so you have to sign into your online banking to check the details. Or you can phone the bank on a number you know is theirs if you don’t bank online.

Agreed. My bank occasionally sends me e-mail messages telling me there is a message for me in the on-line bank which I can then only access by logging-in using a one-time passcode.

I received 5 products from China in 5 weeks. No return address. Then they write a glowing report about what they sent and get access to your info. I am on my fifth credit card in as many weeks. Amazon did nothing. I will never use them again. Also I have my album for sale in there, I did not put it there. Amazon will not tell me where any money is going .

Jeannie says:
13 February 2021

You should always read the wording in the messages carefully as the clue is nearly always there on a scam message. In the Barclays one the word unusual is spelt incorrectly, and there is a full stop after bar on the website address which is clearly not the Barclays website. NEVER click on a link!

Pretty dim scam they cannot even spell unusual correctly, rather than unusal. That would immediately make me suspicious. Not forgetting bar.clays

Called to-day by Asian person stating he new I was due to change my Energy supplier and could offer better deal.Asked who I had changed to I stated that was my business an hung up. Checked out telephone number 01472353009 .Number was not recognized.Must be new scam targeting anyone due to change supplier or elderly.

A woman with a strong Indian/Asian accent tried this on me – said my electricity contract was up for renewal and would increase by 22.6% but if I committed now they would hold the price for a further three years. I smelt an Indian rat – I’ve had these calls before and so I asked her a few questions. She told me she would put me through to an “expert consultant” who said his name was Ben but wouldn’t give a surname, and there was no caller number shown. “We don’t show a number for security.” I told he was actually breaking the law and he got very aggressive. So I asked him which office of my supplier he was calling from. He said he could only tell me that if I gave him my customer number. I told him he was a dirty little liar and was wise to these scams and would report him. He put the phone down! It’s best not to engage these people in conversation unless you can keep one step ahead by asking them questions and not answering any of theirs. I checked with my supplier and they don’t ever make such calls. If they were offering such deals it would be via the post. Everybody needs to be very much aware that these nasty people are out there perpetrating fraudulent scams. If in doubt, put the phone down and check – on another phone and/or line – with your supplier. If a call comes through and doesn’t display a caller number, it’s a fraud. Having said that, only this week I have received three calls to my mobile from “HMRC” which displayed a caller number, telling me that “your NI Number has been compromised and to avoid penalties I must dial 1 immediately.” I terminated the call, and rang the displayed number from a landline. It was unobtainable. This happened twice more, with the same result. I reported it on the HMRC Phishing line and also to the Action Fraud website. What an evil world we live in.

janice says:
13 February 2021

We got a call from an Asian-sounding female, who alleged to be from Microsoft – completely unsolicited call.
Also have had several to mobiles claiming to be from HMRC and from HSBC, who we have never banked with.
We have had several landline calls pertainin g to be from Amazon.
Over the last year there has hardly been a week goes by but we get some odd call.
It feels in a way we are under seige.

9 times out of 10 if our landline rings it is usually a scam, I have been getting a few on my mobile, it usually comes up if its a scam and asks me if I want to block the number. it is usually someone with a very thick accent and they are usually John, Peter, or Lynn very English names.

Belle Hughes says:
13 February 2021

Why does everyone assume the elderly are more stupid? Certainly the scammers do. I had to get a call blocking phone because of the excessive number of nuisance calls I received.
Some of the scams are really sophisticated but many are pretty obvious. I do not think victims should be automatically compensated for not taking simple precautions. In the end it will be all the other bank users that will have to pay that money, the banks will still maintain their huge profits.

Gillian Pearce says:
13 February 2021

I have also had one purporting to be coming from HSBC like this

I had one from HSBC too. I knew it was fake. I also keep getting one saying its from Apple, at least one a day I am getting.

Jean Rapp says:
13 February 2021

I am currently being bombarded with emails purporting to be from McAfee, Norton, and many other online security companies with whom I do not have any accounts. I have reported them to the ‘phishing’ address and sent them to my junk mail/spam folder but they still keep coming. Any suggestions on how to stop this irritating scam.

These are the reasons I refuse to bank online. In fact, I do not do money online full stop. I do not have a smartphone. Trouble is these pests random dial, so it makes no difference if you are ex-directory. I’ve had calls that my broadband will be disconnected due to illegal activity. Amazon account incorrect info , etc, etc . I get calls on my payg mobile for someone I’ve never heard of – they stopped when I threatened trading standards and the police.
Note to self, buy a call guardian phone when shops re-open.!

Linda says:
13 February 2021

I received a text from Santander saying that I have “added a new recipient “ and if it was not me to click on a link. Fortunately I didn’t do so but checked my account first. The text was especially convincing because I had made an online payment to my sister earlier that day.

Barclays scam. You don’t point out the dead giveaway – the word “unusal” indeed you transcribe it as “unusual” which the scammers want you to see. And the dot in “bar.clays”!

Alistair Edwards says:
14 February 2021

Similar text message received yesterday

From 07770 759800
HSBC: New payee has been added to your online banking account.
Not you?
STOP IMMEDIATELY at https://cancelpayee-verifications.com

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

We use a BT Call-blocker phone so any caller from a number which we have not put into the phone address book gets asked to state their name before the phone rings for us to answer. We can then listen to the name and decide whether to answer or block. A lot of scam callers don’t bother once the phone asks for their name.

John Gilbert says:
14 February 2021

I had one from Lloyds bank and I am not even a customer!

Barbara Robinson says:
15 February 2021

Had one from Lloyds the other day