Where do scammers get my bank details?

Your bank account number, sort code, or card details can reach a scammer through several routes, none of which require the scammer to have broken into your bank directly. The most common is phishing: a convincing fake email, text, or website that leads you to enter your credentials into a form controlled by the scammer. The fake site may look pixel-perfect, copying the real bank's design, and the user session can even be proxied in real time so the victim believes they successfully logged in.

Data breaches at merchants, subscription services, and payment processors expose card details that were stored — often improperly — by companies you have bought from. Even if the breach does not expose the full card number, partial information combined with other leaked data can be enough for sophisticated fraud. Card-skimming devices attached to ATMs and petrol station pumps are a physical variant of the same attack.

Malware is a targeted but serious threat. Keyloggers installed on a computer or mobile device can capture every keystroke you type, including passwords and account numbers entered during a genuine banking session. Some malware specifically looks for financial application data and uploads it to a command-and-control server. Infecting a device via a malicious attachment, a fake app, or a compromised website requires only that the victim interact with the malicious element once.

Social engineering is another route. Scammers posing as bank fraud investigators will sometimes call and convince a panicked customer to read out account details or authorisation codes during the call. The caller creates urgency by claiming suspicious activity is happening on the account right now, and the victim's instinct to cooperate with their bank overrides caution. No bank will ever call you and ask you to confirm your full PIN, password, or one-time passcode.