Phone scams: calls, codes and fake platforms

A handful of details are the keys to your account. Never share them with anyone, on any call:

• a one-time code from an SMS or the banking app,
• your PIN,
• the three digits on the back of the card (CVV),
• your banking password.

The bank already knows these; it never needs to hear them from you. Anyone who asks is trying to get into your account.

Two more demands mean the same "hang up now": being told to move money to a "safe account" (a real bank never says this — your account is already as safe as it gets), and being asked to install an app so a "specialist can help", which can hand a stranger control of your phone. Knowing your name and a few card digits proves nothing: that data leaks from deliveries, shops and old breaches.

Scams work on feelings, not on how clever you are: fear ("your money is in danger"), hurry ("in the next ten minutes") and authority ("security service"). Tricking the person instead of hacking the system is called social engineering, and it's how most card fraud in Ukraine happens.

That's why the defence is a rule, not alertness. One rule covers almost every call:

Hang up, and call the bank yourself on the number printed on your card.

Start the call, don't continue theirs. A number on the screen can be spoofed; an employee number can be invented; a number from a message can be the fraudsters'. Only a channel you open yourself — the card's number or the bank's own app — is sure to reach the bank. If the problem is real, it will still be there when you call, and the bank will confirm it.

The National Bank's 2026 list of common schemes repeats a few shapes. Learn the tell for each:

• Fake aid or compensation (lately after missile strikes). A link opens a copy of a bank or state site that asks for card details and a code. That's phishing. Receiving money never needs the card's back digits or a code.
• Investment offers in messengers. A small "profit" is paid first to win trust, then you're pushed to put in much more. Guaranteed high returns don't exist.
• eSIM swaps. Someone moves your number to their device to catch your login codes. The tell: your phone loses signal for no reason — call the bank from another phone.
• Reused old numbers. A number dropped after moving abroad is reissued to a stranger who then gets your codes. Change the number at the bank before you give it up.

Different stories, one habit: check through a channel you start yourself.

If money is already leaving, minutes matter and the order is fixed:

1. Call the bank on the number on your card and block the card and app access. Every minute lets more money go, so stopping the bleeding comes first.
2. Tell the bank which transfers weren't yours, so it can try to halt or trace them.
3. Report to the police on 102 and through the cyber police's online form. This records the crime and may be needed later.
4. Change your banking and email passwords from a device you trust — not the phone the fraudsters may now control.

Keep the evidence throughout: the number that called, the time, screenshots of the messages and the transfers. Don't count on getting the money back — it depends on the case and the rules at the time, and it's much harder when you gave the code yourself. Prevention beats recovery.

A one-time code from an SMS or your banking app isn't a password you prove yourself with. It confirms a single action — a payment, a login, a new device — that someone is doing right now. The bank generated it and already knows it; it has no reason to ask you to read it back.

So turn the request around: if a "bank employee" needs your code, it's because they are the one trying to log in or move money, and your code is the last lock in their way. The same is true of the card's three back digits and your PIN.

This makes a clean rule for the whole family: a code is never read out loud, never typed into a link, never passed to "support". There is no safe exception, because the only person who ever needs your code is you, inside the real app.