In a safe account scam, someone posing as your bank, the police or a fraud team tells you your account is compromised and that you must move your money to a "safe" account they name. No bank, police force or agency anywhere does this. It is the highest-value consumer impersonation scam, and Canadian losses per victim have more than tripled since 2021.
The call comes from your bank’s number. Someone professional and calm tells you there has been suspicious activity — a payment you do not recognise, an attempted login from another country, a card used abroad. They are from the fraud team. They are helping.
Then comes the pivot that defines the scheme: your money is not safe where it is, and it needs to be moved. To a “safe account”, a “holding account”, a “protected account” set up in your name while the investigation runs.
There is no such thing. Not at any bank, in any country, under any circumstances. If an account is genuinely compromised, a bank freezes it, blocks the card and issues new credentials — the money stays exactly where it is. The request to move it is not a step in a fraud investigation; it is the fraud.
It is also among the most expensive consumer scams there is, because the target is not a payment but a balance. Canadian data shows loss per victim rising from about C$5,900 in 2021 to about C$20,200 in 2025. UK Finance recorded £576.4 million in authorised push payment fraud in 2025 across 248,070 cases.
A phishing text about a delivery or a payment. A fake login page. Enough to collect a name, a partial card number, or a recent transaction — so the call that follows can open with something true.
Caller ID shows the number printed on your card. Spoofing costs nothing. Some operations send a text first and let you call them, which is stronger still because you initiated it.
A payment you do not recognise. A login from another country. The caller is not accusing you of anything; they are on your side, and they need your help to stop it.
You are asked to confirm details “for security”. Every answer is either information they wanted or a confirmation that they already had it. A genuine bank asks you to verify yourself to them and never the reverse.
A code arrives and you are asked to read it out — to “cancel the fraudulent transaction”, or to “verify your identity”. It does neither. It authorises the thing they just started.
Where it could have stopped
No bank employee will ever ask you to read out a one-time passcode, and no legitimate process requires it. The code exists specifically to stop the person on the phone. If you are asked for one, the call is fraudulent — full stop, whatever has been said before.
The main event. Transfer your balance to an account they name. It is in your name, they say. It is temporary. You will get a reference number.
Do not tell branch staff what the transfer is for — some staff may be involved in the investigation. If the app asks the reason for the payment, choose “moving my own money”. This step exists to defeat the bank’s own warning screens.
In the courier-fraud variant, someone arrives to collect your card, your cash, or a “damaged” card for destruction. Nobody legitimate ever does this.
The caller is on your side. Unlike a threat-based scam, nothing here is hostile. Someone from your bank has spotted fraud and is helping you stop it. Compliance is not fear; it is cooperation, and it feels responsible.
The premise is one you have been trained to accept. Banks do call about suspicious activity. Sometimes they do freeze cards. The scheme borrows a real process and changes one step in the middle of it.
The number is right, and that feels dispositive. Most people believe caller ID means something. It does not, and this is the scam that most exploits the gap.
Secrecy is imposed in the exact place where the last defence lives. The bank clerk asking what a large transfer is for, and the app warning screen, are the final checkpoints. Being coached to get past them is what turns a scare into a loss.
The one-time passcode step inverts a security control. People have been taught that codes make them safer. Almost nobody has been taught that reading one out hands over the account.
And the pressure is over a balance, not a payment. Most scams ask for a purchase. This one asks for everything, which is why loss per victim in this category is a multiple of most others.
The safe-account scam is most heavily documented in the United Kingdom, where it drove the creation of mandatory reimbursement rules for authorised push payment fraud and the 159 short code, and in Canada, where the Anti-Fraud Centre gives it its own category name — “Bank Investigator”.
Operations run both from overseas call centres and domestically, and the case record repeatedly shows the same escalation seen in tech support fraud: a US prosecution in Rhode Island describes victims lured by pop-ups into calling agents who then told them their financial assets were at risk or could be garnished. That is the same conversation, reached by a different door.
The domestic layer here is the receiving account. The “safe account” is a real account at a real bank, usually a mule account in someone else’s name, and it is the part of the operation that stands inside the victim’s own country. It is also where enforcement usually starts.
The Canadian data adds an uncomfortable detail about how the scheme is changing: reports falling while losses rise. The population being successfully targeted has shrunk, and the harm to each person reached has more than tripled.
The Canadian Anti-Fraud Centre files the safe-account scam under "Bank Investigator", and its open dataset shows two lines moving in opposite directions. Reports fell from 2,311 in 2021 to 1,771 in the first nine months of 2025, while reported losses rose from C$4.7 million to C$18.7 million over the same period. Fewer people are being caught, and each one is losing roughly four times as much.
The FTC reported in August 2025 that combined losses from older adults who lost more than $100,000 to impersonation scams rose eightfold, from $55 million in 2020 to $445 million in 2024. The payment instructions in those cases are physical: cash into Bitcoin ATMs, and stacks of cash or gold handed to couriers.
In May 2025 the US Attorney's Office for the District of Rhode Island indicted eight people over a transnational fraud and money laundering scheme aimed at elderly people in the United States and Canada. Pop-up messages on victims' computers made false claims that lured them into calling live agents, who then told them their financial assets were at risk or could be garnished. Investigators identified around 300 victims in at least 37 states with known losses exceeding million.
UK Finance recorded £1.28 billion in total payment fraud losses in 2025, of which £576.4 million was authorised push payment fraud — money victims sent themselves after being deceived — across 248,070 cases. Impersonation fraud, the category containing the safe-account scam, was one of the few to fall, with losses down 12% and cases down 11%, while investment fraud rose 40%.
On the call. Hang up. You will not be able to argue your way to certainty, and you do not need to. Wait a minute, then call your bank on a number you found yourself — the back of your card, or the app. In the UK, dial 159, which connects you to your own bank and cannot be spoofed.
If you are worried the fraud might be real, that is precisely what calling back resolves.
If money has gone.
Preventing it. Memorise one sentence and tell it to everyone you know: no bank will ever ask you to move your money to another account. It requires no judgement about who is calling, survives a perfectly spoofed number, and covers the entire scheme.
The “safe account” is a real account at a real bank, opened or taken over for the purpose. Frequently it belongs to a money mule — someone recruited through a fake job, a romance, or a payment for the use of their details.
That is exactly why the transfer feels safe. It is domestic, to a named individual at a familiar bank, inside the normal payments system. Nothing about it looks foreign or unusual.
From there the money moves within hours: split across further accounts, withdrawn as cash, converted to cryptocurrency, or spent on goods for export. The speed is why the recall window is measured in hours rather than days, and why the single most useful thing a victim can do is phone the bank before doing anything else.
The other half of this story
Our sibling site Clean on Paper explains why the receiving account looks ordinary — how mule accounts are recruited and layered, and how banks detect them.
No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.
No. There is no such thing. If your account is genuinely compromised, your bank freezes it, blocks the card and issues new details — leaving your money where it is. Being asked to move money anywhere by someone who called you is conclusive.
Caller ID is trivially spoofed, and operations routinely display the number printed on the back of your card. The display tells you nothing. Hang up, wait a minute, and call back on a number you found yourself — in the UK, dialling 159 connects you to your own bank directly.
Usually from a phishing page you visited earlier, a compromised email account, or a data breach. Sometimes the caller induces you to confirm details you think they already have. Knowledge of your account activity is not proof of identity, and it is a documented feature of this scam rather than an argument against it.
It depends where you are. The UK now has mandatory reimbursement rules for authorised push payment fraud, and other jurisdictions are moving that way. Reimbursement is not automatic and does not cover every case, but do not accept a first refusal as final — ask specifically about your bank's reimbursement obligations and escalate to the ombudsman if needed.
Because the code was the last thing stopping them. A one-time passcode confirms a payment or a login that they started. No genuine bank employee will ever ask you to read one out, and no legitimate process requires it.
Never. Banks do not send couriers for cards, cash or documents, and police do not either. If a caller says someone is coming, call the police on your own initiative — this is courier fraud, and the courier is the one person who can be caught.
Report it
Reporting is what produces the enforcement data on this page. Find the right agency and phone number for your country on the report page. If money moved in the last few hours, call your bank first.