What Your Bank or Payment Service Will Never Ask You to Do
Most scam advice focuses on spotting the fake: bad grammar, an odd link, a number you don’t recognise. That advice is getting less useful because the fakes keep improving. A caller can make your provider’s real support number appear on your screen, and a fraudulent text can land in the same thread as genuine messages.
A more reliable test is to ask what a bank or financial service will never ask for, then apply the same standard to provider, including Blackcat.*
The list of requests that no legitimate institution makes is short and stable, and it doesn’t change when the technology improves.
Your PIN, your password and your one-time codes stay with you
Start with the credentials. No bank or payments provider / electronic money institution will never ask for your PIN or password, because neither is information it needs from you. In EU payment law, these are personalised security credentials: features issued to you so the provider can confirm that you are you. It authenticates you by other means and holds its own records.
Anyone asking you to read out a full password wants something their job does not require. One-time codes are where people most often come unstuck. The one-time password scam works because the code feels like a security measure rather than a signature, so handing it over feels careful rather than reckless.
Under the EU’s strong customer authentication rules, that code is tied to one specific amount and one specific recipient.
Reading it out does not cancel a payment or prove your identity. It approves the payment the caller has just set up. The Banco de España puts it plainly: if you haven’t started a transaction, there is no reason for a temporary code to reach you, and less still for anyone to ask you for it by phone.
Here are basic things about these calls that most people get wrong:
- The number on your screen is a suggestion, not a fact. Europol describes caller ID spoofing as the falsification of information sent to the recipient’s display to disguise who is calling. It works on landlines, mobiles and internet calls alike.
- Scam calls run on warehouses of SIM cards. One network dismantled in Latvia in 2025 was running roughly 1,200 SIM-box devices holding about 40,000 SIM cards, used to create more than 49 million online accounts.
- Where the rules stop applying, fraud multiplies. Card fraud was approximately 17 times higher when the payment recipient was outside the European Economic Area, where strong customer authentication is not legally required.
Three requests that move your money
Credentials are only half the picture. The joint EBA and ECB report on payment fraud recorded €4.2 billion of fraudulent payments across the European Economic Area in 2024, and found that the share of fraudulent credit transfers caused by manipulating the payer into sending the money themselves climbed to 74% by value.
A payment you approve yourself is treated differently from one a thief makes in your name.
horizontal scroll
| EEA payment fraud, 2024 | Figure |
|---|---|
| Total value of fraudulent payments | €4.2 billion |
| Fraudulent credit transfers | €2.5 billion (up 24%) |
| Fraudulent card payments | €1.3 billion (up 4%) |
| Credit transfer fraud value caused by manipulating the payer | 74% |
| Share of credit transfer fraud losses borne by payment users | About 85% |
Payment fraud was reported across the European Economic Area in 2024. Source: EBA and ECB, 2025
Three requests do this work:
- The remote access banking scam asks you to install screen-sharing software so that support can “see the problem”. In February 2026, Eurojust coordinated the takedown of a call centre in Dnipro whose staff used exactly this method, taking control of victims’ devices and moving money into accounts the group held. At least nine victims in Latvia and Lithuania lost more than €160,000 between them.
- The gift card payment scam asks you to buy retail vouchers and read out the codes. No institution settles a charge, a fine or a security check in vouchers.
- A voucher code behaves like cash the moment it is spoken aloud, and it leaves no route back.
Beware: There is never a “safe account” to transfer money to, and no provider ever opens a holding account for you during an incident. Where an account does need protection, the control is to block the card and stop payments, not to transfer the balance.
Urgency and secrecy are the methods
Two pressures appear in nearly every one of these calls, and both are tools rather than mood. The urgent bank call scam compresses your decision time: a payment leaves in four minutes, and the account will be suspended tonight.
Time pressure removes the single step that defeats the whole approach: hanging up and calling back on a number you already had.
The second pressure is secrecy. In a keep-it-secret scam, the caller says the matter is confidential, that staff at your local branch may be implicated, or that discussing it would compromise an investigation. Should a bank call be kept secret?
No. No legitimate financial procedure requires your silence, and the instruction is there to stop you from checking with someone who would recognise the setup.
In December 2024, Europol and Eurojust supported Belgian and Dutch authorities in dismantling a group that had worked this way across at least ten European countries, posing as police or banking staff by phone and, with older victims, at the front door.
The advice issued alongside the operation was direct: account details and PIN numbers should not be given out by phone, whatever the caller says about who employs them.
How to check who is contacting you
The safe habit is the same every time. End the contact and reach the provider by a route you chose yourself: hang up, wait for the line to clear, then use the number on the back of your card or the chat inside the app.
For Blackcat specifically:
- Support reaches you through in-app chat or from support@blackcat.app. Treat any other address as unverified.
- Blackcat support will not ask for your PIN, your password, a one-time code, or remote access to your device.
- Nothing from support requires you to keep the conversation private.
Since 9 October 2025, providers across the euro area have had to check the payee’s name against the IBAN before a euro transfer is sent, under the Instant Payments Regulation, and to warn you when the two don’t match.
That check is a real improvement, and it is also an argument against hurrying: a mismatch warning only helps if you stop to read it.
The controls in your Blackcat account
If a call like this has already happened, the useful move is to close the card off rather than argue with the caller. Every Blackcat payment card is enrolled in 3D Secure by default, and transactions are monitored continuously, with payments either declined automatically or passed for manual review.
You can block a card yourself: open the app, select the card, tap “Block card”. It takes effect immediately and can be reversed. If the card needs permanent closure and reissue, support arranges that after the block, and a replacement is posted to your registered address.
Contact support@blackcat.app or the in-app chat, and read more about Blackcat security.
Frequently asked questions
Will a bank ever ask for my PIN or password?
No. The question “Will my bank ask for my PIN?” has the same answer everywhere in the EU.
Your PIN and password are personalised security credentials issued to you, and no legitimate provider requires you to disclose either of them to confirm who you are.
Will the bank support asking for a one-time password?
No. People ask, “Will a bank ask for a one-time password?” because the request sounds like a security check. Under EU rules, that code authorises a specific payment to a specific recipient, so reading it out approves the payment rather than stopping it.
Can a bank ask me to install remote-access software?
No. Screen-sharing tools allow the other person to operate your account as if they were you, which is why fraudulent call centres favour them.
Will a bank ask me to pay with gift cards?
No, no institution does this. Voucher codes behave like cash once read out, and there is no mechanism to reverse them.
Can a bank ask me to transfer money to a “safe account”?
There is no such account. Genuine protection means stopping payments on the affected card or account, not moving your balance to a new account.
Why do scammers create urgency and demand secrecy?
Because a deadline stops you from verifying. Secrecy does the same job from the other side, removing the people who might recognise the pattern. Both pressures exist to prevent the one action that works: ending the call and dialling back yourself.
How can I verify a message from Blackcat support?
Close the message, open the app yourself and start an in-app chat, or write to support@blackcat.app.
