Fraudsters with an official title
Fraud by fake officials explained by Ilia Zavialov: the call, the script and the rule that stops it
A caller says they are from HMRC, the police or the bank's fraud team working with officers. They know the company's name, a director's name and the bank. They need a payment today to stop a penalty, a freeze or an arrest. The script is old and it still works in the United Kingdom, where payment fraud took 1.28 billion pounds in 2025, 4 percent more than the year before, and authorised push payment cases alone reached 248,070 with 576.4 million pounds lost. Sixty six percent of those cases began online and a further 17 percent through telephone networks. This piece explains how the impersonation is built, what the caller already knows, and the one verification rule that defeats it.
English version for the United Kingdom.
01
Why an official name works so well
A call from a stranger asking for money fails almost every time. A call from somebody who says they are the tax authority, the police or the financial regulator succeeds far more often, because it borrows an authority the listener has been trained to obey since childhood.
The title does three jobs at once. It explains why the caller knows things about the company, it explains the urgency, and it makes refusing feel like obstruction of an official process rather than ordinary caution.
Companies are a particularly good target. Somebody in finance handles payments every day, is used to acting on instructions from above, and does not want to be the person who delayed a legal matter that later turned out to be real.
The fraud works on the procedure rather than on the individual. A careful employee who follows an instruction from a convincing official is doing exactly what they were hired to do, which is why the defence has to be written into the procedure too.
The same script is aimed at households, and it lands differently there. A private person loses savings, while a company loses money that belongs to its payroll, its suppliers and its tax bill, and the loss then becomes a story that clients and the bank hear about.
02
The four scripts that repeat
The tax script: an unpaid liability, a penalty accruing daily, and an offer to settle today to avoid an audit or a freeze on the company account. The payment goes to a special account supposedly used for settlements.
The investigation script: a director or an employee is named in a criminal case, a colleague is supposedly under suspicion, and the company is asked to cooperate confidentially by moving funds to a safe account while the case is examined.
The regulator script: an inspection, a licence problem or a compliance breach, resolved by paying a fee or by confirming account details on a portal that looks official.
The protected account script: somebody from the bank, working with the police, reports that the company account is compromised and that the money must be moved at once to a secure account they control. All four end in the same place, a transfer the company initiates itself.
03
What the caller already knows
The detail that convinces people is usually public. Company registration numbers, directors' names, the address and the accountant's name are available in registries and on the company's own website.
Leaked data adds the rest: an employee's personal number, a recent invoice, the name of the bank. None of it proves the caller is an official. It proves the caller did research, which fraudsters do and officials rarely need to.
Spoofed numbers complete the picture. The caller identification can show the real number of a police station or a tax office, and it proves nothing, because the displayed number is chosen by the caller.
So the rule for staff is simple to state. Knowledge about us is not evidence of authority. The only evidence is a call that we initiated ourselves, to a number we found ourselves.
It helps to know how the research is done, because it tells you where it can be interrupted. Most of it comes from three places: the public registry entry, the team page on the company website and professional network profiles that list who works in finance. None of those can be hidden entirely, and the realistic aim is to make sure that knowing a name never unlocks a payment.
04
The numbers in the United Kingdom
Payment fraud in the United Kingdom took 1.28 billion pounds in 2025, 4 percent more than in the previous year, across more than four million confirmed cases in London, Manchester, Birmingham and everywhere else.
The part this article is about is authorised push payment fraud, where the victim sends the money themselves. It reached 248,070 cases and 576.4 million pounds, and impersonation of the police, HMRC and bank staff is a standard route into it.
Sixty six percent of those cases started online and a further 17 percent through the telephone network, which is why the call, the text and the fake portal are the three doors to watch.
The protection for victims improved. Mandatory reimbursement has applied since 7 October 2024 with a limit of 85,000 pounds per claim, and in the first nine months 88 percent of money claimed back was returned, 112 million pounds in total.
05
The verification rule for the company
End the call and ring back through a published number. Not the number the caller gives, not the number shown on the screen, but the number from the agency's official website or from previous correspondence you already hold.
No official body requires payment by gift card, cryptocurrency, a transfer to a named individual or a transfer to a so called safe account. Any of those requests ends the matter regardless of what came before it.
Apply the two person rule to any payment requested by an outside authority. The person who took the call does not approve the payment, and the approver verifies independently before anything moves.
Real agencies put demands in writing through formal channels and allow time to respond. A demand that must be paid within the hour, with a warning not to tell anybody, describes the fraud and not the agency.
Treat the call back as routine rather than as suspicion. Staff find it much easier to say we always ring back through the published number than to say I think you might be a fraudster, and a genuine official will never object to the first.
06
Why smaller companies are hit hardest
A large company usually has a treasury function, dual approval built into its banking and a security team that has seen this call before. A company of twenty people often has one person who pays the bills, the director's phone number on the website and no written rule at all.
That is not a criticism, it is the reason the fraud targets them. The caller needs one person with authority to move money and nobody positioned to question them, and small firms supply that combination by default.
The fix costs nothing and takes an afternoon. A written call back rule, a second approver for any payment requested from outside and a named person told about every such call close the gap that the script is built to use.
07
Who to call and where to report in the UK
HMRC does not demand immediate payment by phone with threats of arrest, and it does not accept payment by gift card or cryptocurrency. A call that opens with a same day demand is the scheme.
Since 4 December 2025 fraud in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud: reportfraud.police.uk or 0300 123 2040. In Scotland report to Police Scotland on 101.
Call your bank through the number on the back of a card or on its website and use 159 where your bank supports it. For a push payment, report quickly: reimbursement claims are decided fast, 84 percent within five business days in the first year.
If the caller claimed to be a police officer, ring the force on 101 from another phone, or wait a few minutes before calling on the same line, and ask whether the officer and the case exist.
08
What the finance team should write down in advance
A one page instruction for anybody who handles payments: official bodies are verified by calling back through a published number, and no payment requested by phone is made the same day.
A named person who is told about every approach of this kind, including the ones that were refused. Patterns repeat, and the third call to a company is usually better prepared than the first.
A list of the real agencies the company actually deals with, with their published contact details and the name of the usual contact. Having the real number to hand removes the temptation to use the one supplied.
A rule that confidentiality requested by a caller is itself a warning. Genuine investigations do not rely on an employee hiding a payment from their own management.
A short rehearsal once a year. Ten minutes in which somebody plays the caller with a convincing script and the payments team practises ending the call and ringing back turns a rule on paper into a reflex, and the reflex is what works under pressure.
09
If money has already gone
Call the bank immediately through the number on its website or on a card, and ask for the payment to be recalled and the receiving account to be flagged. Hours matter here more than completeness.
Write down everything while it is fresh: the numbers, the names and titles used, the exact wording of the demand, the time of each call and the account details supplied.
Report to the police and to the agency whose name was used. Agencies track impersonation of themselves and use the reports to warn others and to trace the accounts.
Expect a follow up call offering to recover the money, sometimes from a supposed second official. It is the same operation returning to a company it now knows will pay.
| Who they say they are | What they claim | What the real body does |
|---|---|---|
| HMRC officer | Unpaid tax, arrest or account freeze today | Writes first and never takes gift cards or crypto |
| Police officer | The company is part of an investigation | Never asks anybody to move money to protect it |
| Bank fraud team with police | The account is compromised, move funds | Never asks you to transfer to a safe account |
| Financial Conduct Authority | A compliance problem solved by a fee | Does not collect fees by phone or message |
| Companies House | A filing problem with a penalty to pay now | Uses its own service and published payment routes |
| DVLA or a council | An unpaid charge with a link to pay | Uses gov.uk, not a link in a text |
| Border Force or courier | A parcel held until a fee is paid | Does not collect fees through a message link |
Questions and answers
The caller knew our director's name and a recent invoice. Doesn't that prove it is real?
No. Directors' names come from public registries and invoices from leaked or intercepted email. Knowledge proves research, and officials rarely need to prove anything by reciting your details.
The number on the screen was the real number of a police station. Is it genuine?
Not necessarily. Caller identification can be spoofed, so the displayed number is chosen by the caller. Only a call you place yourself to a number you found yourself proves who is on the line.
They told us not to tell anybody because the investigation is confidential. What does that mean?
It means the call is a fraud. Genuine investigations do not rely on an employee hiding a payment from their own management, and secrecy is requested precisely because a second person would stop the transfer.
What single rule protects a company best?
End every call that asks for money and ring back through a published number, with a second person approving any payment requested by an outside authority. That rule defeats every version of the script.
Can HMRC call a company and demand payment today?
Not in the way this scheme does it. HMRC does not demand immediate payment with threats of arrest and does not accept gift cards or cryptocurrency. A same day demand by phone is the fraud.
Where does a UK company report an impersonation attempt?
To Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or 0300 123 2040, and to the bank. In Scotland report to Police Scotland on 101.