Bank Password Request: What to Do

TL;DR

A bank asking for your password to an encrypted document is a major red flag. It’s almost certainly a scam. Do not provide the password. Contact your bank directly using official channels (website, phone number from statements) and report the request.

Why This Is Suspicious

Banks should never ask you for the password to decrypt files. Here’s why:

• Security Protocols: Banks have secure methods for accessing your information if needed, and they won’t require your direct password input.
• Password Storage: They shouldn’t store your passwords in a way that requires them to ask you for it later.
• Phishing Tactic: This is a common tactic used by scammers to steal your credentials and access your accounts.

What To Do If Your Bank Asks For Your Password

1. Do Not Provide the Password: This is the most important step. Even if the email or message looks legitimate, do not share your password.
2. Contact Your Bank Directly: Use a known-good phone number or website address (from your bank statement or official website – not from the suspicious communication). Explain the situation to them.
3. Report the Incident:
   • To Your Bank: They need to be aware of potential phishing attempts targeting their customers.
   • To Action Fraud (UK): Report it online at https://www.actionfraud.police.uk or call 0300 123 2040.
4. Check Your Accounts: Monitor your bank accounts and credit reports for any unauthorized activity.

Identifying a Scam Email/Message

Here are some things to look out for:

• Generic Greetings: “Dear Customer” instead of using your name.
• Poor Grammar and Spelling: Scammers often make mistakes in their writing.
• Urgent Tone: They may try to pressure you into acting quickly without thinking.
• Suspicious Links or Attachments: Avoid clicking on links or opening attachments from unknown senders.
• Unusual Request: Asking for passwords, PINs, or other sensitive information is a major red flag.

Example Scam Email Indicators

Look closely at the sender’s email address. It might appear similar to your bank’s official address but have slight variations.

legitimate_bank@example.com  vs. legitimate-bank123@example.net

What If You Already Gave Them the Password?

1. Change Your Password Immediately: Change your password for that account and any other accounts where you use the same password.
2. Contact Your Bank: Inform them of the breach so they can take steps to protect your account. They may need to freeze or close your current account and issue a new one.
3. Monitor Your Accounts Closely: Watch for any unauthorized transactions.
4. Consider Credit Monitoring: If you’re concerned about identity theft, consider signing up for a credit monitoring service.

Further Resources

• Take Five Campaign (UK): https://takefive-campaign.org.uk/ – Provides advice on avoiding fraud.
• Financial Conduct Authority (FCA): https://www.fca.org.uk/consumers/scams – Information about financial scams.