HSBC UK phishing scams: fake calls, texts and recovery

A fake HSBC UK call, text or email can look convincing because the fraudster only needs a few familiar details to create trust. The useful question is not whether the message looks professional, but whether you can verify the contact independently and protect the account before money or security credentials leave your control.

Verify the contact and protect security codes

Caller ID, a sender name and a polished copy of the HSBC UK logo are not authentication. A criminal can spoof a number or place a fake text into a convincing message thread. The safe test is deliberately inconvenient: stop the conversation, close the message and start a new contact with HSBC UK from a channel you found independently. HSBC UK is a large bank with digital, telephone and branch routes plus many customers who make international payments, so choose a route that does not depend on the suspicious message itself.

Suppose a text says a £3,120 transfer is being held and asks you to call a number within ten minutes. Do not use that number. Open the official app or type the bank's known web address yourself, then check the account activity. If no matching alert appears, that difference is useful evidence. If a real transaction is present, report the transaction through the genuine bank channel rather than continuing with the sender.

Fraudsters often describe an SMS code as a cancellation code, reference number or identity check. In reality, a one-time passcode may approve a payment, register a device or reset access. HSBC UK staff do not need you to help a stranger defeat the bank's own security controls. Never type a code into a site reached from an unexpected message and never read it aloud to a caller.

The same rule applies to app approvals. If a login, new-device request or payment confirmation appears when you have not initiated it, decline it and secure the account. Repeated prompts are not evidence that the request is genuine; they are often a sign that someone is trying several times and hoping fatigue will produce one accidental approval. For HSBC UK, keep this point attached to the exact phishing review, with its date and case reference, so it cannot be confused with a separate issue later.

Stop the scam and contain account risk

An impersonator may say your HSBC UK account has been compromised and that money must be moved to a temporary or protected account. That request reverses the normal logic of bank security. A real bank can restrict, investigate or protect an account internally; it does not need a customer to send savings to an account controlled by an unknown third party.

If the caller uses police language, an employee number or a supposed fraud-team case reference, write those details down but do not let them keep you on the line. End the call. A genuine case will still exist when you contact HSBC UK independently. A fake case usually collapses the moment you remove the fraudster's control over the communication channel.

If you entered HSBC UK credentials on a suspicious page, approved a device or disclosed a code, secure access before spending time composing a perfect report. Change compromised passwords through the genuine service, review trusted devices, lock or replace the affected card when appropriate and protect the email account and mobile number used for recovery. A compromised email inbox can let an attacker reset banking access again after you fix the first problem.

Also check for a SIM-swap warning: unexplained loss of mobile service can mean your number has been moved to another SIM. Contact the mobile provider as well as HSBC UK. Keep screenshots of the fake site or message, but do not keep interacting with the fraudster merely to gather evidence. Evidence is useful; giving the attacker another opportunity is not.

Classify the loss and build an evidence timeline

The refund route depends on the mechanics. If a criminal used your card or account without your authorisation, unauthorised-payment rules are relevant. If you were deceived into authorising a UK Faster Payment or CHAPS transfer yourself, the APP-scam reimbursement framework may be relevant instead. The Payment Systems Regulator's current framework sets a standard maximum of £85,000 per eligible claim; firms can use an excess of up to £100 in some cases, but not for vulnerable consumers. For HSBC UK, keep this point attached to the exact phishing review, with its date and case reference, so it cannot be confused with a separate issue later.

Most eligible APP claims are expected to be decided and reimbursed within five business days, although the firm can pause the clock for information and has an overall 35-business-day outcome limit in qualifying cases. Those numbers are not a promise that every phishing loss is reimbursable. Card purchases, cash, cheques, civil disputes and payments outside the scope of the rules follow different routes. For HSBC UK, keep this point attached to the exact phishing review, with its date and case reference, so it cannot be confused with a separate issue later.

A strong fraud record is chronological. Note when the first HSBC UK message or call arrived, what the fraudster claimed, which number or address was used, what you clicked or disclosed, the exact payment amount and reference, and when you first contacted the genuine bank. Save the original message and screenshots instead of paraphrasing them from memory days later.

For a £3,120 loss, a useful file might contain six items: the fake text, a screenshot of the payment, the recipient details, the time you called HSBC UK, the fraud case number and any follow-up email. That is far more useful than a long narrative with no dates. If the incident involves an overseas merchant or transfer, separate the currency, exchange-rate and correspondent-bank questions from the fraud or dispute itself.

Escalate the decision and avoid recovery scams

If HSBC UK rejects a reimbursement or recovery request, ask for the reason in writing and check which rule the decision relies on. A payment-services complaint normally has a 15-business-day final-response target, extendable to 35 business days in exceptional circumstances. Other complaint types can have different time limits, so read the final-response letter rather than assuming every banking complaint uses the same timetable.

If the final response does not deal with the evidence, or the firm does not respond within the applicable period, the Financial Ombudsman Service may be able to review the case. Keep the bank's reasoning, your timeline and the original evidence together. The Ombudsman can assess what happened; it is much harder to do that if the key messages, payment reference or call dates have disappeared. For HSBC UK, keep this point attached to the exact phishing review, with its date and case reference, so it cannot be confused with a separate issue later.

People who have already lost money are attractive targets for recovery scams. A new caller may claim to be a solicitor, tracing service, regulator or specialist who can recover the HSBC UK loss for an upfront tax, release fee or security deposit. Do not send more money to retrieve the first loss. Official complaint and Ombudsman routes do not require a stranger to receive a private 'unlocking' payment.

The practical end point is simple: secure the account, stop further transfers, report the incident through genuine channels and keep a clean evidence trail. Once those four jobs are done, you can evaluate the refund decision calmly. Before they are done, every extra conversation with the fraudster adds risk and very little useful information. For HSBC UK, keep this point attached to the exact phishing review, with its date and case reference, so it cannot be confused with a separate issue later.

Sources and verification

• HSBC UK - official website
• Payment Systems Regulator - APP fraud reimbursement
• FCA ScamSmart
• Financial Ombudsman Service

HSBC UK: figures and process descriptions were checked against the provider's official material and current UK regulatory/consumer-protection sources. Product terms and support routes can change, so verify the live rule before acting on a later transaction. For HSBC UK, keep this point attached to the exact phishing review, with its date and case reference, so it cannot be confused with a separate issue later.