{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-uk-safe-account-bank-and-police-impersonation-drives-450-7m-in-app-fraud"},"incident":{"title":"UK 'safe account' bank and police impersonation drives £450.7M in APP fraud","date":"2025-05-19","date_precision":"day","victim_org":"UK banking customers (multi-victim campaign)","sector":"Financial Services","country":"United Kingdom","primary_vector":"Vishing (Voice Phishing)","secondary_vectors":["Smishing (SMS)","Credential Phishing Portal"],"ai_involvement":"Unknown","ai_notes":"UK Finance's 2024 reporting does not break out AI-enabled impersonation as a separate category.","outcomes":["Wire Fraud / Financial Loss","Identity Theft","Credential Theft"],"loss_usd":null,"loss_note":"Losses are reported in sterling: £1.17 billion total fraud in 2024, of which £450.7 million was authorised push payment fraud (£365.7 million personal and £84.9 million non-personal) across under 186,000 cases. Safe account impersonation losses fell 16 percent and cases fell 32 percent year on year.","records_affected":186000,"threat_actor":null,"summary":"UK Finance's 2025 annual fraud report recorded £1.17 billion in total UK fraud losses for 2024, including £450.7 million lost to authorised push payment fraud across under 186,000 cases, the lowest APP case volume since 2020. Within that, impersonation scams in which criminals pose as a bank or the police and tell the victim to move money to a so-called safe account saw losses fall 16 percent and case numbers fall 32 percent against 2023.","how_it_worked":"A caller presents as the victim's bank fraud team or as police, often after a preparatory text or a spoofed caller ID matching the number on the back of the bank card. The victim is told their account has been compromised by a criminal, potentially an insider at the bank, and that the only way to protect the balance is to transfer it immediately to a new safe account which the caller supplies. Because the victim authorises the payment themselves, normal card fraud controls do not apply. The levers are institutional authority, fear of loss, and the instruction not to discuss it with branch staff who might be complicit.","lessons":"No bank or police force ever asks a customer to move money to a safe account; confirmation of payee checks, in-app warnings at the point of transfer and mandatory delays on first-time large payees are the effective controls.","confidence":"Confirmed","sources":[{"title":"Fraud continues to pose a major threat with over £1 billion stolen in 2024","url":"https://www.ukfinance.org.uk/news-and-insight/press-release/fraud-report-2025-press-release","publisher":"UK Finance"},{"title":"Smishing: Package Tracking Text Scams","url":"https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams","publisher":"United States Postal Inspection Service"}],"entry_type":"campaign","slug":"2025-uk-safe-account-bank-and-police-impersonation-drives-450-7m-in-app-fraud","year":2025,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-uk-safe-account-bank-and-police-impersonation-drives-450-7m-in-app-fraud"}}