'A direct debit has been set up' scam text: don't call the number

The wave: fake Nationwide and Barclays texts

Which? reported two versions in late summer 2026:

• 26 August 2026: a text claiming to be from Nationwide, sent from a spoofed UK mobile number, saying a standing order has been set up on your account and giving a number to call if you did not set it up.
• 21 September 2026: a text claiming to be from Barclays, saying a direct debit has been set up on your account and that you need to call a number to cancel the payment.

In both cases Which? says the number puts you through to a fraudster intent on getting your personal information.

Why a phone number instead of a link

Most warnings say "do not tap the link", so a text with only a phone number can feel safer. It is not. The number is the fraudster's own, so when you call it you are talking to them, not to your bank, and it feels like the call was your idea.

On the phone they can use the scripts banks warn about. Nationwide, for example, describes the "safe account" scam: someone says they are from your bank, building society or the police, tells you your money is at risk, and asks you to move it to a "safe account" they have set up. Nationwide says a genuine organisation would never ask you to do this.

What your bank will not ask

Nationwide lists what it will never ask you to do:

• give your full one-time code or card reader code;
• transfer your money to a safe account;
• log in to its internet bank through a link in an email, text or social media message;
• use, re-enable or re-sync your card reader over the phone.

The NCSC's general rule is the same: your bank, or any other official source, will never ask you to supply personal information by email, or call and ask you to confirm your bank account details.

How to check without calling the number

1. Do not call the number in the text, and do not reply.
2. Open your banking app, or type your bank's web address yourself, and look at your direct debits and standing orders. A new one that had really been set up would show there.
3. To speak to your bank, call 159 or the number on the back of your card. Stop Scams UK says 159 connects customers of more than 99% of UK retail bank current accounts directly with their bank, and cannot be spoofed; more than one million calls have been made to it.
4. Forward the text to 7726 so your provider can block the sender.

Some banks can also confirm a call inside their app: Nationwide has a Call Checker, and says that without the app you should hang up and dial 159.

If you already called and gave details

1. Call your bank straight away on 159 or the number on your card, and tell it what you shared: codes, card details, passwords, or any payment you made.
2. Report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
3. Forward the original text to 7726.

More on texts that claim to be your bank: how to check a bank text. The scam text checker flags "a direct debit has been set up" wording and "if this was not you" lines, and the UK number checker shows what kind of number the text came from.

Sources

• Which? scam alerts, bank texts (Aug-Sep 2026): Which? scam alerts, 26 August 2026: "Sent from a spoofed UK mobile number, a text claiming to be from Nationwide tells you that a standing order has been set up on your account. It goes on to provide a number to call if you didn't set this up, which will put you through to a fraudster intent on getting your personal information."; 21 September 2026: "A scam text claiming to be from Barclays tells you that a direct debit has been set up on your account. It also says that you need to call a number to cancel this payment, which will put you through to a fraudster intent on stealing your personal information." — https://www.which.co.uk/news/article/the-latest-scam-alerts-from-which-aBRLy2b02WkC, read on 2026-09-30
• Nationwide, scams guide: Nationwide, Scams guide: "We'll never ask you to: Give us your full one-time code or card reader code. Transfer your money to a safe account. Log directly into the Internet Bank via a link in an email, text or social media message. Use, re-enable or re-sync your card reader over the phone. ... [Call Checker in the app] If you don't have our app, hang up and dial 159 ... Someone calls saying they're from a trusted organisation, like a bank, building society, or the police. They explain your money is at risk ... move it now to a 'safe account' they've set up for you. ... A genuine organisation would never ask you to do this." — https://www.nationwide.co.uk/help/fraud-and-security/scams, read on 2026-09-30
• Stop Scams UK, 159: Stop Scams UK, 159 phone number: "the short code number now connects customers of more than 99% of the UK's retail bank current accounts safely and directly with their bank. Unlike many long-form numbers, 159 cannot be spoofed or impersonated. ... more than one million calls having been made to the number since it's inception." — https://stopscamsuk.org.uk/our-work/159-phone-number/, read on 2026-09-30
• NCSC, what banks never ask: NCSC, How to spot a scam email, text message or call: "your bank (or any other official source) will never ask you to supply personal information via email, or call and ask you to confirm your bank account details." — https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams, read on 2026-09-29
• Stop! Think Fraud, reporting: Stop! Think Fraud (UK Government campaign), Reporting fraud: "Report suspicious phone calls and text messages free of charge to 7726. To report a phone call, simply send a text to 7726 with the word 'Call' followed by the scam caller's number. ... If you've lost money or you think a fraudster has access to your bank account, tell your bank ... Always contact them directly using a known email or phone number, such as the ones shown on their website or the back of your card, or call 159. ... contact any other relevant organisation ... an organisation whose name was falsely used in the fraud (such as an energy provider or Driver and Vehicle Licensing Agency) ... Before you delete the email, forward it to report@phishing.gov.uk ... Report suspicious websites to the National Cyber Security Centre" — https://stopthinkfraud.campaign.gov.uk/reporting-fraud/, read on 2026-09-30
• NCSC, forwarding to 7726: NCSC, Report a scam text: "Most phone providers are part of a scheme that allows customers to report suspicious text messages for free by forwarding it to 7726. If you forward a text to 7726, your provider can investigate the origin of the text and arrange to block or ban the sender, if it's found to be malicious." — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-09-29
• Report Fraud: Action Fraud / City of London Police press release, 4 Dec 2025: "From Thursday 4 December 2025, anyone needing to report cyber crime or fraud will be directed to our new Report Fraud service. Report Fraud has replaced Action Fraud, for use in England, Wales and Northern Ireland. People affected by cyber crime or fraud in Scotland should continue to call Police Scotland using the 101 telephone number. ... reportfraud.police.uk or by calling 0300 123 2040." — https://www.wired-gov.net/wg/news.nsf/articles/Report+Fraud+service+goes+live+04122025143000; https://www.reportfraud.police.uk/, read on 2026-09-29