PanicStation.org
UK USA
uk Money & financial emergencies

What to do if…
your debit card PIN is changed and you did not request it

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Freeze or block the card immediately, then contact your bank using a trusted route, such as the official app or the number on your card or statement. Treat it as possible account takeover until your bank confirms what happened.

Do not do these things

  • Don’t try the changed PIN in a shop or at a cash machine to test it.
  • Don’t click links in a text or email about a PIN change or security alert.
  • Don’t share one-time passcodes, security codes, card details, PINs, or banking passwords.
  • Don’t approve in-app prompts you did not start.
  • Don’t call back a number from a text, email, or unexpected caller.
  • Don’t move money around in a rush if you suspect your banking login, phone number, email, or device may be compromised.

What to do now

  1. Freeze or block the debit card right now.
    Use your banking app if you can do this safely. If you cannot, call the bank using the number on your card or statement and ask them to block the card immediately, including cash withdrawals.

  2. Contact your bank safely and state the problem clearly.
    Say: “My debit card PIN was changed and I did not request it.”
    Use your bank’s official app, the number on the back of your card, or the number on a recent statement. If this started with a suspicious call, hang up first. You can dial 159 to reach many UK banks safely; if it does not work for your bank or phone, use the official number on your card, statement, or banking app.

  3. Ask the bank to lock down anything that could keep the other person in control.
    Ask them to check and, where needed, stop or reset:

    • recent PIN change activity
    • cash withdrawals
    • mobile and online banking access
    • new devices linked to your banking
    • changes to your phone number, email, or address
    • debit cards added to any digital wallet
    • new payees, standing orders, or unusual payment instructions

  4. Ask for the old card to be cancelled and replaced.
    Confirm that the old card cannot be used for cash withdrawals, card payments, or digital wallet payments. Ask whether your replacement card will have new card details.

  5. Check recent activity while you are still with the bank.
    Look for cash withdrawals, card payments, new payees, bank transfers, and digital wallet activity you do not recognise. Ask the bank to log any disputed activity as unauthorised and to tell you what they have blocked.

  6. Secure the routes that could have allowed the PIN change.
    From a device you trust, if possible:

    • change your online banking password, passcode, or memorable information through the official app or website
    • change the password for the email account linked to your bank
    • turn on strong two-step verification for that email account if it is available
    • contact your mobile network if you stopped receiving calls or texts, lost signal unexpectedly, or received messages about a SIM change

  7. Get a reference and a safe contact plan.
    Ask for a case or reference number. Ask how the bank will contact you, what they will never ask for, and how you can verify that any follow-up contact is really from them.

  8. Report the fraud route after the bank access is secured.
    If you are in England, Wales or Northern Ireland, you can report fraud or cyber crime to Report Fraud online or by phone. If you are in Scotland, you can report fraud to Police Scotland by phone, online, or in person.

  9. If the bank does not resolve it or you are unhappy with the response, use the complaints route.
    Ask the bank how to make a formal complaint. If the bank’s response does not resolve it, check whether you can take the complaint to the Financial Ombudsman Service.

What can wait

  • You do not need to decide today whether to close your account or switch banks.
  • You do not need perfect evidence before contacting the bank; stopping access comes first.
  • You do not need to report to several organisations at once. Secure the bank access first, then make any fraud report in calmer steps.
  • Identity-protection steps such as Cifas Protective Registration can wait until the bank is secured, unless your bank says there is an immediate identity-fraud risk.

Important reassurance

A PIN change you did not request is a genuine warning sign, and freezing the card is the right first move. You are not overreacting by stopping access first and asking the bank to check what happened.

Scope note

These are first steps only, to stabilise the situation and reduce the chance of further loss. Later decisions about complaints, refunds, identity protection, or account changes may need help from your bank or another specialist organisation.

Important note

This is general information, not legal, financial, cyber security, or professional advice. Bank processes vary. If you feel pressured during any call or message exchange, stop and contact your bank again using a trusted route.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us