Fraud and security

While online shopping may be quick and convenient, it provides criminals with the opportunity to trick people into paying for products and services that do not exist. These are often advertised via social media and auction sites using fake photographs.

Please take care fraudsters are working very hard and impersonating legitimate shops, these are often accessed via links on social media (Facebook, Tik Tok or Instagram).

Below are some important tips to help you spot the warning signs and avoid being scammed online.

• If you’re paying for high value goods, such as technology or even vehicles, don’t pay anything upfront unless you’ve physically seen the item. Be suspicious of offers that seem too good to be true.
• Avoid paying for goods via bank transfer. Using a debit or credit card offers you greater protection.
• Do your research and check the seller's reviews.

Remember if the deal appears too good to be true then it more than likely is.

Banks, law enforcement, HMRC or any other trusted organisation will never ask you move money to safe account, allow access to your bank account, or request your online/mobile banking login details.

They’ll claim that fraudulent activity has been spotted on your account or that they’re concerned about the safety of your money.

They will get you to tell them enough account information or security details to gain access to your account to steal your money, or even get you to move your money to a "safe account" yourself.

They may ask you to disclose the One-Time Passcode we send you as part of our security procedures. Never disclose this to a caller, not even us, we will never ask for this code, please terminate the call.

Fraudsters will try to pressure you into buying worthless or non-existent shares. These can include crypto-currency, gold or even wine. They’ll use a variety of sales approaches to contact you, so please be cautious.

Fraudsters may also ask you to open a new account with a third-party bank to transfer funds too. A reputable Investment company would not ask you to do this, and we would deem this as being highly suspicious.

Use the FCA's ScamSmart Investment Checker to avoid potential scams: ScamSmart - Avoid investment and pension scams | FCA

Also known as an advance fee scam, this is when you’re convinced to pay an upfront fee in order to receive a prize/service, high-value goods or loans which never materialise.

How to spot an Advance Fee Fraud:

1. You’re asked to pay an upfront fee to receive money, a prize/service or goods that you weren’t expecting
2. You’re asked to pay an upfront fee for a training programme or background check for a job that may not exist
3. You’re told that fees are fully refundable and will be used as a deposit, administrative charge or for insurance
4. There are follow-up fees you need to pay in order to secure the loan, prize/service or goods
5. You are put under pressure to pay quickly by wire, bank transfer or cryptocurrency
6. The domain name doesn’t match that of the sender of the email e.g. gov.uk

We are aware of scams involving individuals being offered loans for an advanced upfront fee by organisations posing as a representative of us (Virgin Money). We do not charge up-front fees for our loans and would not approach you directly in this way.

If you believe you’ve fallen for a scam, report it to us. Alternatively you can contact us via email at report.fraud@virginmoney.com.

Fraudsters may contact you claiming to be from Virgin Money and appear genuine.

They will claim you need to take action to protect your account because it's been compromised. They may ask you to:

• share a one-time passcode
• delete your Mobile Banking app

Doing either of these could give a fraudster access to your money.

We will NEVER contact you and ask you to share your security details or one-time passcodes.

These codes should never be shared. They are one time use, numeric codes which are used to confirm your identity or approve genuine transactions you've made.

The codes will not initiate a refund or reverse a transaction.

If you've shared any security details, call us using the number on the back of your card and report it to Action Fraud Link opens in a new window.

Avoid buying gig, festival or sports tickets from anyone apart from official vendors, the box office or reputable fan seller sites.

If you do, you could be a victim of fraud.

Criminals typically pose as a seller and post on social media or an online marketplace. They'll tell you they’ll post or email the tickets once you’ve transferred the money to their bank account.

But when you try to contact them after nothing’s arrived, they’ve disappeared off the face of the earth.

This happens to thousands of music, sports and other fans every year who get tricked into buying fake or non-existent tickets.

Remember to:

• buy tickets only from the venue’s box office, official sellers or reputable fan sites
• don’t click on social media, text or email links or attachments offering tickets, as they could link to fraudulent or malware sites
• avoid paying for tickets via bank transfer
• check sellers’ privacy and returns policies
• keep receipts until after the event

Find out more about the Get Safe Online campaign Buying Tickets Safely Online Link opens in a new window.

We’ve seen an increase in fraudsters calling our business customers pretending to be from our Fraud or Payments team, saying there are unusual payments on their account. They’re providing fake reference numbers and asking customers to call them back on a number that they control. They are also directing customers to fake websites or live chat, asking them to share passcodes and activation codes, trying to get them to authorise payments in the app or activate a mobile device on internet banking.

If you take any of these actions, a fraudster could get access to your account, and you are at risk of losing money.

Please follow the below top tips and share these with anyone in your business who has access to your accounts.

Our top tips

• Watch out for phone calls, texts or emails that look and sound like they are coming from us, asking you to take action. Phone and text numbers can be spoofed. If you are not certain you are dealing with the Bank, contact us immediately.
• We’ll NEVER ask you to provide us with activation codes or one-time passcodes.
• We’ll NEVER direct you to a website or live chat or ask you to download software or an application. Fraudsters can set up fake websites, designed to steal your personal or banking information.
• NEVER allow anyone to remotely access your devices.
• We’ll NEVER contact you to authorise, re-authorise or reverse payments. If someone does, it’s a scam and you should hang up and call us directly.
• We’ll NEVER ask you for a Token 3 response. Token 3 responses are only used to authorise payments. At times, we may ask you for a Token 1 response to verify your identity.
• We’ll NEVER ask you to add a code to your landline or mobile phone. Codes starting *21* are used to set up call forwarding which could direct your calls to a fraudster. You can find out more here - All about Call Diversion | BT Help. Link opens in a new window

Fraudsters may call you claiming they are from your bank or another trusted organisation.

These can seem genuine if they have ‘spoofed’ the number and worked out which companies you use. The caller will claim you need to provide banking details or have to transfer money urgently. They may even claim they need remote access to your device to help sort the issue.

How it works

The caller will claim you need to provide banking details or have to transfer money urgently. This could sound innocent to begin with like a refund or mistake, or more worrying like an overdue fine.

Examples include bogus callers claiming to be from:

• Your bank or law enforcement saying they are investigating fraud and need you to move funds/hand over cards.
• Your utility provider saying a refund is due to you or there’s an issue with your payment.
• Your internet provider saying there’s a security issue with your service or devices.
• Tax authorities saying you have penalties due and could be arrested.

Be careful, fraudsters may try and use these techniques:

• Claim they need remote access to your device to fix the issue. Once they have access they can manipulate what is shown on screen – all part of convincing you to hand over information or authorise payments.
• Ask you to say or type PINs and one-time passcodes into the handset. Whatever the technique, they want this information so they can access your money.
• Fraudsters are good at handling scepticism and may ask you to call back on the number on the back of your bank card. They then keep the line open so that you unwittingly connect back to them.

How to protect yourself from phone scams

• Be wary of all unsolicited calls.
• Remember - the bank will never ask you to verify your PIN, say or type in a one-time passcode, transfer your money to a ‘safe account’ or give remote access to your device.
• Don’t depend on the caller ID – remember this can be spoofed. If in doubt hang up and call from another phone. Make sure to use a number from an official source (back of your card, company website etc).
• Stay in control - don’t be pressured into sending money or making financial decisions.

Report a suspected phone scam

If you’ve had a suspicious call report it to us. Alternatively you can contact us via email at report.fraud@virginmoney.com. If you believe you are in danger call 999.

A text might not be from who you think. To make messages seem genuine, scammers can spoof phone numbers and caller IDs so that they match or look similar too the real one. This also means the message might appear on your phone in the same thread as genuine ones.

How it works

Text scams are all about getting you to click a link leading to a bogus website, or to call a number which connects you to scammers.

Examples include bogus messages claiming to be from:

• Banks saying there has been a suspicious transaction on your account, or a new payee has been set up.
• Delivery firms saying there are fees due on a parcel.
• Tax authorities claiming you are due a rebate.

The message might have a link, which goes to a website asking you to enter personal and banking details. Copycat sites can be sophisticated and might appear professional or very similar to the real site, so be careful of trusting them just because they look the part. Alternatively the message might say to expect a call from the bank. The fraudster will then call and attempt to trick you into providing information or authorising transfers.

How to protect yourself from text message scams

• Be suspicious of any message urging you to click a link to provide information or make payments.
• Remember that phone numbers and caller IDs can be faked to look genuine. If the message seems strange in any way, stop and check it’s genuine.
• Don’t call the number the text is from or any number given in the message. Instead call a number you trust (from the back of your card or official company website/paperwork).

Report a suspected text message scam

If have received a suspicious message report it to us. Alternatively you can contact us via email at report.fraud@virginmoney.com.

Criminals don’t just call or send messages, they use email too. Always be wary of emails you weren’t expecting, even if the sender is someone you know like the bank or some other company you have an account with. The reason is because the sender can be faked, and sometime the bogus email will look similar to a genuine one.

How it works

Emails are sent by fraudsters, usually claiming to be from a company and featuring brand names and logos that are familiar. They’ll include a link or attachments, taking you either to to bogus websites that will ask for information or install malware that can steal information from your device. These emails are becoming more sophisticated and may even have some of your personal details such as your address, employer or a password you’ve used. Personal information is gathered by fraudsters from social media and from data that has been circulated online after a company has had a data breach, and it’s used to tailor messages, so they seem plausible. It’s really important not to assume an email is genuine just because it is personalised.

Examples include bogus messages claiming to be from:

• Big name brands like Amazon, Apple or ebay with an invoice or a message about activity on your account.
• Social media platforms asking you to verify or unlock your account, or retrieve messages you missed.
• Banks saying your account is locked or restricted.
• Firms or individuals saying you have won or inherited money.

Here’s some red flags that suggest an email might be suspicious

• The tone is urgent and insists you provide details or send money immediately.
• There are threats of penalties or loss of service if you don’t act.
• The email is unexpected or makes a request that’s out of the ordinary.
• The phrasing seems strange, or there are spelling and grammatical errors.
• The claims seem a little too good to be true like prize money or exclusive access to products and services.

How to recognise a genuine email from us

• We’ll always use your name.
• We’ll include the last part of your post code or card number or mobile phone number.
• Emails we send will never include a link to any login or other page asking you for account or card details, your PIN, login details or password.

How to report suspicious emails

If you’re suspicious of an email claiming to be from Virgin Money, please don’t respond and forward it to us at report.phishing@virginmoney.com.

We can’t reply, but we investigate all reports. All emails received are shared with a third party who helps us to remove fraudulent websites as quickly as possible. Please don’t include any personal information when forwarding emails.

Remember never click on attachments or follow any links contained in suspicious emails.

Online fraud covers everything from online shopping to online banking, but one thing can help prevent both: take the time to install the built-in security measures most browsers and many banks offer. These can help protect you whether the criminals are trying to dupe you with fake pop-ups in your online banking window, sending you ‘scam alert’ messages hiding malware, or faking retailer websites to make you input your financial details.

Fraudsters often use malicious software (malware) to steal your security details or take control of your computer. Malware can be installed without your consent or knowledge, usually when you open phishing emails (scam emails) or visit fraudulent or infected websites, including links from social media sites.

How to protect yourself against malware

• Don’t reply to, or open links in, unsolicited emails.
• Only use reputable websites.
• Don’t install any software unless you’re absolutely sure where it came from and what it does.
• Use internet security software on your PC and keep its virus database up to date.

Identity theft happens when someone uses your personal information, without your knowledge or consent, to carry out fraudulent activity. They may use your details to open new accounts or apply for loans or credit cards in your name.

What fraudsters look for

The type of information fraudsters look for includes:

• Name and address
• Date of birth
• Passport and driving licence details
• Birth certificate
• Bank account details

Identity theft – warning signs

Here are some warning signs that may indicate potential identity theft:

• Receiving bills, invoices or receipts for goods or services you haven’t requested.
• Letters from debt collection agencies for debt that you don’t recognise.
• Letters confirming or rejecting applications for credit that you haven’t applied for.
• Delivery of mail order goods that you didn’t order.
• No post at all – fraudsters may have redirected your mail to another address.

How to avoid identity theft

You can minimise the risk of identity theft by following these tips:

• Don’t leave personal papers lying around and don’t carry valuable personal information.
• Always check your bank and credit card statements for any suspicious transactions.
• Make sure you dispose of any old, unwanted paper statements in a secure way, for example by shredding.
• If you receive an unusual request for information by email or over the phone, don’t provide it unless you can confirm the request is genuine.
• Be careful what information you share on social media or when accessing your personal or financial information on a public computer.
• Check your credit report with agencies such as Experian  link opens in a new window Link opens in a new window. This will show any false applications made in your name.

Report identity theft

If you suspect you’ve been a victim of identity theft or you’ve noticed any suspicious transactions on your account, please contact us immediately on 0345 607 6991.

We are here from 8am to 8pm Monday to Friday, 9am to 4pm on Saturday and 10am to 3pm on Sunday.

Investment fraud, sometimes known as ‘share sales fraud’ or ‘boiler room fraud’, involves the use of high pressure sales techniques to convince you to invest in worthless or bogus stocks and shares.

Share sale fraud (or ‘boiler room fraud’) uses high pressure, cold call sales techniques to tempt you into investing in worthless or bogus stocks and shares.

Most fraudsters using this technique operate from outside the UK, but they may use UK telephone numbers and addresses to disguise themselves.

If you invest in these funds you won’t be able to claim compensation in the UK, as the funds are not UK-based and are not authorised by the Financial Conduct Authority.

How to spot share sale fraud

To help you spot this type of scam, here are some warning signs to look out for:

• Cold calls, often from overseas – fraudsters use this technique to try and catch out inexperienced investors. Hang up and ignore future phone calls.
• High pressure sales pitches – persistent, and sometimes abusive or threatening techniques are used to try to intimidate you. Don’t be pressured into something you’re not sure about.
• ‘Unique’ investment opportunities – fraudsters will often offer opportunities to ‘get in on the ground floor’ by providing access to shares in small, unquoted companies. Always be on guard if you are asked to keep the offer secret
• Upfront fees – some fraudsters will ask you to pay an upfront fee for taxes or as security. Never provide your bank account details, or debit or credit card information unless you’re certain you are dealing with a legitimate firm.
• Not authorised by the Financial Conduct Authority – all stockbrokers and investment firms must be authorised by the Financial Conduct Authority (FCA) to do business in the UK. Always get the company’s FCA number and check it against the FCA website link opens in a new window Link opens in a new window

Protect yourself from share sale fraud

• Always take professional and independent financial advice before considering an investment.
• Ask questions to make sure you fully understand what you’re investing in.
• Compare the market to see if the opportunity is valid.
• Know who you’re dealing with - look up the company with the FCA link opens in a new window Link opens in a new window and Companies House link opens in a new window Link opens in a new window
• Take your time to make an informed choice, never be rushed into a quick decision.
• Don’t believe everything you are told.
• Don’t buy investments from firms not regulated by the FCA.
• Don’t invest in a complex scheme that’s hard to understand or relies on a ‘secret’ strategy.
• Don’t pay any money upfront until you’ve checked out the company you’re dealing with.

Remember, if it sounds too good to be true, then it probably is.

Dealing with suspected share sale fraud

If you think you’ve been a victim of share sale fraud, you should:

• Break off all contact with the fraudster straightaway.
• Tell your bank immediately if you have given your bank account information.
• Keep any written communication with the fraudster, as this may help you give evidence to the authorities.
• Be aware that you may be a target for other types of fraud, as fraudsters often share details.
• Report the fraud to Action Fraud link opens in a new window Link opens in a new window

It’s not hard for criminals to investigate business invoice details (even down to payment dates) and then pose as regular suppliers. If a supplier contacts you to make a formal request for bank account details to be changed, always verify with that supplier using their on-file details. It’s important that everyone inside a business is warned of the dangers of invoice fraud, and that everyone knows to always check invoices to identify potentially fraudulent transactions as soon as possible.

If you believe you have been the victim of Invoice Fraud and have issued a payment, please report it to us immediately. Alternatively you can contact us via email at report.fraud@virginmoney.com.

If you receive an email from your CEO or some other senior member of staff asking you make an urgent payment outside of normal procedures, don’t automatically follow their lead. It’s become very easy for fraudsters to manipulate the characteristics of an email, including the sender address, so that it looks genuine, but when you transfer the money, it goes straight to an account controlled by a criminal. Keep an eye out for any emails that might be written in a different style to usual, and always check any unusual payment requests directly, ideally in person or by telephone, to confirm the instruction is genuine.

If you believe you have been the victim of CEO Spoofing and have issued a payment, please report it to us immediately. Alternatively you can contact us via email at report.fraud@virginmoney.com.

A money mule is a person who transfers illegally obtained money between different payment accounts, very often in different countries, on behalf of others. The money usually comes from different types of cybercrime e.g. phishing and malware attack, as well as other kinds of fraud such as romance scams and holiday fraud (booking fraud).

If you have been asked to issue a payment on someone’s behalf please report it to us immediately. Alternatively you can contact us via email at report.fraud@virginmoney.com.

Authorised push payment fraud is where someone tricks you into sending them money from your account. They often do this by contacting you via phone, email or social media and pretending to be someone else – such as your bank, a contractor, an estate agent or the police.

Fraudsters will use a variety of stories to get you to issue funds via electronic payment, in cash or persuade you top purchase goods to hand over to them. Virgin Money will never ask you to transfer money to a safe account or disclose your log in details.

If you have been asked to issue a payment by a 3rd party please report it to us immediately. Alternatively you can contact us via email at report.fraud@virginmoney.com.

There are many different fraud and scam types not covered here. The links below offer helpful advice and information:

• Little book of big scams – Metropolitan police PDF opens in a new window Link opens in a new window
• Investment scams – Scam Smart Link opens in a new window