AI Phone Scams Targeting UK Bank Customers: How to Stay Safe

How AI Voice Cloning Fraud Works

Authorised push payment (APP) fraud - where victims are manipulated into transferring money to fraudulent accounts themselves - has been the fastest-growing fraud category in the UK for several consecutive years. The National Cyber Security Centre (NCSC) identified a significant escalation beginning in 2024 in the use of AI voice synthesis tools by criminal groups specifically targeting UK bank customers and their families.

The typical method involves criminals obtaining short audio samples of a target's voice - often sourced from social media videos, voicemail recordings, or publicly accessible video content - and feeding these samples into commercially available AI voice synthesis tools. These tools can generate a synthetic voice that reproduces the pitch, cadence, and accent of the original speaker with sufficient accuracy to deceive family members or to imitate a bank fraud prevention officer's professional telephone manner.

UK Finance data shows that APP fraud losses in the UK reached approximately £460 million in 2024, with telephone-initiated fraud accounting for a substantial proportion of cases. The average loss per victim in telephone-initiated APP fraud was significantly higher than in online-initiated cases, reflecting the greater psychological pressure applied in real-time voice interactions.

The Two Main AI Voice Scam Scenarios

The NCSC has identified two primary AI voice scam patterns affecting UK consumers. The first is the family emergency scenario, where a synthetic voice impersonating a family member - typically a child or grandchild - calls to report an emergency requiring an urgent money transfer. The urgency and emotional content of the call are designed to override the recipient's normal caution.

The second and more prevalent scenario involves impersonation of a bank's fraud prevention team. The caller, using an AI voice modelled on a professional male or female voice, contacts the target claiming that fraudulent activity has been detected on their account and that funds must be moved immediately to a designated safe account to protect them. The safe account is controlled by the fraudsters. Banks have consistently communicated that no genuine bank fraud team will ever make this request.

How to Identify an AI Voice Scam Call

The NCSC advises consumers to be alert to calls that create artificial urgency, request immediate money transfers to unfamiliar account numbers, ask for one-time passcodes to be read out during the call, or claim to be from a bank's fraud prevention team requesting account or card details. All of these requests are hallmarks of APP fraud regardless of whether the voice is AI-generated or human.

AI-generated voices can be highly convincing but often exhibit subtle characteristics that distinguish them from genuine human speech. These include slightly unnatural pauses between sentences, inconsistent background noise patterns, an inability to respond naturally to unexpected conversational tangents, and occasional audio artefacts where the synthesis model transitions between phonemes. However, AI voice quality is improving rapidly and these signals are becoming less reliable as detection cues.

The most reliable defence is procedural rather than perceptual. The FCA ScamSmart campaign advises consumers to hang up immediately on any call requesting money movement or account access, and to call back using a number sourced independently from the bank's official website or the back of their debit or credit card. Never call back on a number provided during the suspicious call itself, as this may reconnect to the fraudsters.

The Family Safe Word Defence

Establishing a family safe word is a practical defence against AI voice impersonation of family members, recommended explicitly by the NCSC in its consumer guidance. A safe word is a pre-agreed phrase - known only to immediate family members - that can be requested during any urgent call from someone claiming to be a family member. A genuine family member will know the safe word; an AI voice system or a human fraudster will not.

The safe word should be something memorable but not publicly associated with the family - not a pet's name visible on social media, not a shared hobby mentioned in public profiles. The NCSC recommends choosing an entirely random word or phrase and keeping it private to the immediate household. The safe word system works only if all relevant family members are aware of it and willing to use it without embarrassment in an urgent situation.

Your Reimbursement Rights Under PSR Rules

The Payment Systems Regulator introduced mandatory APP fraud reimbursement rules that took effect in October 2024. Under these rules, banks and payment service providers are required to reimburse victims of APP fraud in the majority of cases, up to a maximum of £85,000 per claim. The rules apply to Faster Payments transactions and cover the most common routes used in telephone-initiated APP fraud.

Reimbursement can be refused only in limited circumstances: where the victim ignored a specific, clear warning from their bank at the point of making the transfer; where the victim acted with gross negligence, defined as a significant departure from normal consumer behaviour; or where the claim involves first-party fraud. The PSR has made clear that being deceived by a sophisticated AI voice scam does not automatically constitute gross negligence, and the FOS has upheld multiple claims from victims of voice-based APP fraud where the deception was assessed as highly convincing.

Consumers who have been defrauded should notify their bank immediately by calling the number on the back of their card, request that a Faster Payments recall be initiated, and submit a formal reimbursement claim under the PSR rules. If the bank refuses the claim, escalation to the Financial Ombudsman Service is available free of charge.

How and Where to Report AI Voice Fraud

All suspected fraud should be reported to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040. Reports should include the time and date of the call, the number displayed (including any spoofed numbers), a description of what was said, any account numbers or sort codes provided by the caller, and the amount transferred if money was moved. Action Fraud passes reports to the National Fraud Intelligence Bureau, which identifies patterns and coordinates law enforcement responses.

Banks should also be notified immediately. Faster Payments recall success rates drop significantly after 24 hours as funds are moved through multiple accounts rapidly by experienced fraud networks. Immediate notification gives the bank the best chance of initiating a successful recall before funds are dispersed.

Frequently Asked Questions

Will my bank refund money lost to an AI voice scam?

Under PSR mandatory reimbursement rules effective October 2024, most APP fraud victims are entitled to reimbursement up to £85,000. Being deceived by AI voice technology does not automatically constitute gross negligence. Submit a formal reimbursement claim to the bank immediately and escalate to the FOS if the bank refuses.

How does a family safe word work in practice?

A safe word is a pre-agreed phrase known only to immediate family members. On receiving an urgent call from someone claiming to be a family member, asking for the safe word immediately identifies whether the caller is genuine. A fraudster using an AI voice will not know the word. The system works only if all family members are briefed and willing to use it without hesitation.

What should be done immediately after receiving a suspected AI scam call?

Hang up immediately. Do not call back on any number provided during the call. Call the bank using the number on the back of the card to report the contact and check whether any account access occurred. Then report to Action Fraud at actionfraud.police.uk. If money was transferred, notify the bank within the hour to maximise the chance of a successful Faster Payments recall.

Are AI voice scam calls getting harder to detect?

Yes. The NCSC has noted that AI voice synthesis quality is improving rapidly and the audio artefacts that previously identified synthetic voices are becoming less reliable as detection cues. Procedural defences - such as always calling back on a known number and never acting under telephone pressure - are more reliable than attempting to identify AI voices by their sound quality alone.