Scam intervention: a day on a bank's fraud prevention line

Scam intervention is what a bank does between holding a payment it suspects a scammer is behind and deciding whether to send it: a trained colleague calls the customer, asks the questions that fit the likely scam, listens for answers someone else has scripted, and then holds, releases or refers the payment. In the UK the work runs against two legal clocks, because a bank that delays a payment must have reasonable grounds and tell the customer why by the end of the next business day, and must decide by the end of the fourth. It is hard because the customer is usually not lying to the bank on purpose: they have been coached by someone they trust. Botminds' APP Fraud Detection is software for this line. Its agents name the likely scam behind each held payment with the evidence, write the questions for that scam, flag coached answers during the call and keep every word for later; the colleague decides.

This page follows one shift on the line at Corvane Bank UK, the fictional sample bank the solution runs on: its customers, payees and colleagues are invented, and every number about them is sample data, not a customer's result. The rules and research come from the regulators and studies linked where they appear.

What is scam intervention in banking?

Scam intervention is a bank stepping into a payment its own customer has authorised, because the customer may have been tricked into making it. That is what separates it from ordinary fraud work. In an authorised push payment (APP) scam nobody steals a password: the customer logs in, passes every security check and sends the money themselves, usually to an account a criminal controls. The Federal Reserve's ScamClassifier, a US reference model, calls the most common pattern on a UK line a bank impostor scam, in which someone poses as the bank and ends up "instructing a customer to make a payment to protect the customer’s money".

The UK gave banks a specific power for this work in October 2024. Under the Payment Services (Amendment) Regulations 2024, a sending bank that has "reasonable grounds to suspect" a payment follows fraud by someone other than the payer may delay it, and the regulations give the reason for the delay: to contact the payer, or another relevant party, and make further enquiries. The intervention call is that purpose. The full clock is set out in the UK bank payment delay rules.

Regulators have also said what a good call looks like. In its review of firms' fraud controls, the Financial Conduct Authority found that "manual intervention for potentially high-risk payments, where customers need to interact with a staff member before a payment instruction is confirmed, can create positive friction in the payment journey and be helpful in preventing some fraudulent payments", and it tied the benefit to "trained and experienced staff". The rest of this page is about what that training is up against, hour by hour.

07:00: the queue the night left behind

A colleague on the scams line starts the day on held payments, not on a list of alerts. The fraud detection engine has scored every outbound payment overnight and through the early morning, and the ones above the bank's intervention threshold are waiting. At the sample bank 118 had been held by mid-morning. What the colleague needs first is not the score but the clock: who must be called within the bank's own call target, whose delay notice is due today, and whose hold reaches its legal limit at midnight.

On Hannah Okafor's start page the six that need her come in that order. Eileen Marsh, 71, is sending £14,300.00 to a new payee and the agents name safe-account impersonation at 91%. Gordon Haines, 63, is sending £2,200.00 to an M Ivanova; the payee check was unavailable and the likely scam is a romance. Margaret Doyle, 68, has £19,900.00 held since the previous Friday, payable to "Evidence Account 2", police impersonation at 94%, and today is her fourth business day.

The start of a shift: held payments in clock order, each with the scam the agents think is behind it

The other names on the page show how varied a morning is. Felicity Grant, 45, is paying a builder £27,480.00; her last three payments to the builder went to an account in its name, and today's invoice names a different one, the shape of an invoice redirection. Aaron Pike, 34, is paying £3,900.00 to a motor dealer whose name the payee check matched, and a colleague has asked to release it. Every one of these is a payment the customer has chosen to make. The colleague's job is to find out who chose it for them.

Why did my bank call me about a payment? The colleague's side of the call

The bank calls because something about the payment, the payee or the customer's morning looks like a known scam, and the law lets it pause the payment only while it asks. From the colleague's side, the reasons are concrete. For Eileen Marsh the agents listed nine, each linked to where it came from: the payee check said the name on the receiving account did not match, the receiving account was nine days old and had taken six payments from six banks in 48 hours, she had moved £12,000 out of her savings eleven minutes earlier, and she had been on a phone call for the whole of her 41-minute app session.

The strongest reason was her own voice. At 09:52 she had rung the bank's card helpline, and the transcript, opened from the signal, shows what she said when the adviser asked if anything was worrying her:

"No, no. Someone from your fraud team is helping me. I'll be fine."

Eileen Marsh, the sample customer, on the card helpline at 09:53

The bank's telephony showed no call from Corvane to her in 30 days. That pairing, a customer who believes the bank is helping her and a bank that has not called her, is the core of a safe-account scam, and it is something a fraud score cannot express. FinCEN's red flags for older customers describe the same scene at a branch counter, a customer taking instructions from someone on their mobile phone while they transact. On the phone line, the colleague is listening for it.

What questions do banks ask about a payment, and why "is this a scam?" is the wrong one

Banks ask questions written for the scam they suspect, in an order designed to surface a script: who contacted you, whose name is the receiving account in, what is the money for, has anyone told you not to tell us, and is someone going to call you back. A generic question gets a generic answer. The scammer has usually warned the customer that the bank will ask whether this is a scam, and told them to say no.

Eileen's call shows how the questions do their work. The safe-account script opens with whether anyone has been in touch about her money. She says nobody, which contradicts her own call to the card helpline an hour earlier, so the second question is rewritten to ask whose name the new account is in. The third asks what the £14,300 is for. Her answer, at 3 minutes 12 seconds, is the one the scammer gave her: a kitchen, and then, "the man said if the bank asked, I should say it was for a kitchen." The fourth asks whether anyone has told her not to tell the bank, and the fifth whether someone will ring back. Both answers add to the picture.

Questions written for one scam, and the coaching heard on the call

Two things in that exchange are easy to miss. The second question changed because of the first answer, which a fixed script cannot do. And the flag on the third answer quotes the customer's words and the time, so the team leader, the vulnerable customer specialist and, months later, a claims handler can hear exactly what the colleague heard. How to run the same discipline when the customer is in love with the scammer rather than afraid of him is the subject of romance scam intervention.

10:42 to 11:31: one held payment, minute by minute

From the hold to a protected customer took 49 minutes on the sample case, and the call itself took seven of them. Most of the rest was the work around the call: deciding, getting a second person to approve the protective step, a specialist's call back, and the written notice the law requires.

At 11:03 Hannah held the payment to the end of Wednesday 28 October, the fourth business day, under the reason "customer answers match a coached cover story". In the same step she referred Eileen to the vulnerable customer team and proposed a seven-day block on new payees in the app, because the caller had said he would ring back at eleven and might ask her to try again. A block is an account protection measure, so it went to Daniel Whitcombe, the team leader, who approved it at 11:12. At 11:20 Ruth Calloway, the vulnerable customer specialist, called Eileen back and, with her agreement, added her daughter as a trusted contact and booked a branch visit for the next morning.

The Financial Conduct Authority's guidance on the delay power, FG24/6, explains why that branch visit matters as much as the hold. It records that firms asked to be able to talk customers out of a payment, because a customer who trusts the fraudster can respond to a refusal by paying through another bank, "and so the consumer harm would still occur". The final guidance confirms that a bank may try to dissuade the customer from paying the scammer by some other route. A held payment protects one transfer; a customer who understands the scam protects the next.

How long can a bank hold my payment? The two clocks on the colleague's screen

Under the UK rule a bank can delay a qualifying payment no later than the end of the fourth business day after it received the order, and only if it established reasonable grounds by the end of the first. The rule adds that the delay may last only as long as the enquiries need, and FG24/6 reads that as an instruction to send the payment as soon as the enquiries are done, not to wait for the fourth business day as a matter of policy.

The colleague therefore works with three times on every row. The first is the bank's own target for calling the customer, at the sample bank 30 minutes from the hold; that is a policy, not law. The second is the end of D+1, by which the customer must be told about the delay, the reasons and what the bank needs. The third is the end of D+4. For a payment held on Thursday 22 October those were the end of Friday 23 October and the end of Wednesday 28 October.

Margaret Doyle's payment shows the third clock at work. Held on Friday 16 October, it reached the end of its fourth business day on Thursday 22 October, with a branch visit at 14:00 not yet confirmed. The solution escalates a hold to a team leader four hours before its limit by default, and it had already done so. At the end of D+4 a bank must decide; it cannot keep holding. Its notice to Eileen said the same in plain words: if the bank could not be sure by the end of Wednesday 28 October that the payment was safe, it would not send it, and the money would stay in her account.

The D+1 notice: why the payment is paused, what the bank needs, and the latest date

What does a fraud prevention colleague do all day? Fewer forms, more calls

A fraud prevention colleague on a scams line spends the shift reading held payments, calling customers, deciding, and writing down why. Before the call they have to assemble the payment, the payee, the account history and the customer's recent contacts with the bank from several systems. After it they write up what was said and draft the delay notice. Botminds estimates, on its own sample workflow and deliberately modestly, that this surrounding work takes about 34 of an intervention's 46 working minutes by hand.

The minute that matters most does not move. The call stays at roughly the same length because the customer sets its pace, and a colleague who is reading three systems while the customer talks is not listening. What changes is that the reading has been done when the phone rings, and the write-up builds itself from the call as it happens, with every flagged answer tied to its second. At the sample bank's volume, about 2,600 interventions a month, that difference is the shift.

How do banks stop scams on the phone? Five things the colleague must be able to show

Banks stop scams on the phone by establishing, before the payment leaves, that the customer is acting on someone else's script, and by saying so in a way the customer can hear. The decision then has to stand up later, to a team leader the same morning and possibly to a claims handler or the Financial Ombudsman Service months on. FG24/6 lists what a bank should keep about every delayed payment so it can test its outcomes under the Consumer Duty: why it suspected fraud, how long the delay lasted, whether the payment was finally sent or refused, its value, and whether the customer showed characteristics of vulnerability.

The fourth item is where the line most often goes wrong, and the warning is where it most often goes wrong silently. A warning the customer clicked through will not carry much weight if the payment later turns out to be a scam, because the reimbursement rules look for an intervention that is specific to the scam and the payment. Bank scam warnings that work covers what that means in practice.

Where APP Fraud Detection's agents stop and the colleague starts

In Botminds' APP Fraud Detection seven agents do the reading, naming, asking, listening and writing, and none of them can hold a payment, release it or contact the customer. The payment signals agent gathers the evidence. The typology agent names the likely scam with a confidence and the alternatives, and below 0.70 says "unclear" so the colleague uses the general script. The script agent writes the questions from the bank's approved scripts. The listening agent flags coached answers, secrecy, urgency and a caller who will ring back, each tied to the second of the call. A vulnerability agent proposes referrals by the FCA's drivers; the specialist decides. A notice agent drafts the D+1 notice and checks that it mentions no internal referral. A final agent keeps the append-only trail.

The thresholds are the bank's. At the sample bank a payment scored 700 or more is held for an intervention, a release of one scored 800 or more needs a team leader, and the call target is 30 minutes; each is a setting, changed only with approval and kept on the audit trail. How the agents are built and what each may never do is set out in scam detection software: seven agents and what none may do. To see the whole case screen by screen, start from APP Fraud Detection.

Questions people ask

What is a scam intervention call?

It is a call from your bank's fraud team about a payment it has paused because it may be part of a scam. The colleague will ask who contacted you, what the payment is for and whether anyone told you what to say. In the UK the bank must tell you about the delay and its reasons by the end of the next business day, and the sample bank's own notice reminds customers that it will never ask them to move money to keep it safe.

Can my bank refuse to send my payment?

Yes, in some circumstances. A UK bank may delay a payment for enquiries until the end of the fourth business day, and its terms of business may allow it to refuse one; FG24/6 points banks to the existing refusal rules in the FCA's Approach Document. If the bank cannot satisfy itself that the payment is safe, the money stays in your account.

Why does the bank ask so many questions if I authorised the payment?

Because in an authorised push payment scam the customer always authorises it. The questions are designed to show whether someone else is directing the payment; in the sample case the customer's answer about a kitchen was the cover story the caller had given her, flagged 3 minutes 12 seconds into the call.

Do I have to answer my bank's questions about a payment?

You do not have to, but the bank may not be able to decide without the answers. The UK rule lets the bank ask for any information or action it needs to decide whether to send the payment, and it must tell you what that is in its delay notice.

Who is on a bank's scams intervention team?

Typically fraud prevention colleagues who make the calls, team leaders who check high-risk releases and protective blocks, and vulnerable customer specialists who arrange support. The FCA's review of firms found that intervention works best when it is done by trained and experienced staff.

Does a scam intervention call stop the scam?

A hold stops the payment; only the conversation can stop the scam. FG24/6 records that customers who trust the fraudster may simply try another bank, which is why it confirms a bank may try to deter the customer from paying by any other means, and why the sample case ended with a branch visit and a trusted contact rather than a refusal alone.