Recognise pressure
Unexpected urgency, secrecy or a demand to move money should prompt a pause. A familiar logo, caller name or sender address does not by itself establish that a request is genuine. Avoid acting on instructions simply because they appear to come from someone you know.
Protect the details that unlock access
Do not disclose a password, PIN or one-time sign-in code to someone who contacts you. Do not install remote-access software at an unsolicited caller's request. Open the bank's address yourself rather than following an unexpected sign-in link.
Check through a separate channel
If a message concerns your account, stop the conversation and use contact details you already trust. Do not rely on a telephone number or reply address supplied only in the suspicious message. Verify changes to payment instructions independently.
Respond promptly
If you think account access or a payment may be affected, contact your established banking support channel. Keep the relevant messages and transaction information. Use secure messages for confidential account details and explain what happened without sending passwords or one-time codes.