Your parent shared a banking OTP

Why this needs action right now

If your parent shared a one-time password or transaction code with someone on the phone or by SMS, treat this as urgent. That code is what let the transfer go through, and every minute now affects what the bank can still do.

You do not need to understand exactly how the call happened before you act. You only need to know that a code was shared and a transfer followed.

Stay with your parent while you make the calls below, since they may still be shaken and unsure what happened.

What an OTP or TAC actually protects

A one-time password (OTP) or transaction authorisation code (TAC) is a short code your bank sends to confirm that you, and only you, are approving a transfer. It exists precisely so that no one else can move your money, even if they know your account details.

A genuine bank, police officer, or courier never needs this code for any reason. Asking for it is itself the clearest sign the call was not real.

Once the code is shared, whoever has it can complete a transaction as if your parent had approved it themselves.

The calls to make in the next few minutes

Call your parent’s bank fraud line first and report the transfer as unauthorised. Ask the bank to block the card, freeze online banking access, and check whether a hold or recall on the receiving account is possible, and read how a bank recall works so you know what to expect.

Next, call the National Scam Response Centre on 997, especially if the transfer happened within the last few hours. It coordinates quickly with banks in exactly this kind of case.

Change your parent’s online banking password and app PIN from a separate device, since the same call may have gathered other details too.

How this call usually reached your parent

These calls usually arrive as a message or call claiming a parcel is stuck, a bank transaction looks suspicious, or an urgent case needs verification. The request for a code comes later, once your parent already believes the caller is genuine.

Read about how this phishing pattern typically unfolds, and about the closely related authority impersonation approach, where a caller claims to be police or a regulator. Knowing the pattern helps you explain to your parent, calmly, why it was not their fault.

What happens after the urgent calls

Once the bank and the National Scam Response Centre have been contacted, keep the message or call details your parent remembers, including any numbers used. This becomes part of the record for a police report and any later step.

If you want a wider view of what to do first, read the full first-hour guide and work through it with your parent at a pace that feels manageable for both of you.