Someone opens their banking app at ten at night and sees three transactions they did not make. Their heart is going, they do not know whether to freeze the card first or call, and they are typing into whatever contact route they can find.
The only thing that matters in the next sixty seconds is that they reach the right number.
Show the urgent route before anything else
The fraud line, the hours, whether it is answered around the clock and how to freeze a card in the app. This belongs at the top of any security page and in front of any conversation about fraud, ahead of every other piece of content.
Never collect details
Card numbers, account numbers, passwords, security codes and one-time passcodes must never be entered into a chat window. An assistant that asks for any of them is training customers to do exactly what fraudsters ask.
Example conversations
These scripts use information an institution might publish. Your answers should come from your own pages.
Customer: There are transactions on my account I did not make. Assistant: Please contact the fraud team straight away on the number shown here, which is answered around the clock. If you can, freeze your card in the app first, and the page explains how. Do not share any card or security details here. Would you like the link to the app instructions?
Customer: Someone called me saying they were from the bank. Was that real? Assistant: The security page explains what the bank will and will not ask for, and says plainly that staff never ask for your full PIN, passwords or one-time passcodes. If you are unsure about any call, hang up and use the number on this page. If you think you gave anything away, please contact the fraud team now.
Customer: I clicked a link in a text and entered my details. Assistant: Please call the fraud team immediately using the number here so your account can be secured. The page also explains what to do next, including changing passwords and where to report it. Do not enter any of those details here.
Publish what you will never ask for
Full passwords, PINs, one-time passcodes and requests to move money to a safe account. Publishing this plainly is the single most effective anti-fraud content an institution can produce.
Explain the impersonation patterns
Calls, texts and emails claiming to be the bank, a delivery company or an authority. Describing the shape of these, without alarming people, helps customers recognise them.
Make freezing a card obvious
Where it is in the app, how fast it takes effect and that it can be reversed. A customer who can freeze a card in ten seconds loses far less than one queuing.
Explain what happens after a report
Investigation, timescales, provisional refunds where they apply and how the customer is kept informed. Publishing this reduces the anxious chasing that follows every report.
Route vulnerable customers carefully
Someone who has been targeted may be distressed, embarrassed or at further risk. The route must lead to a person quickly, and nothing about it should feel like a form.
Never comment on liability
Whether a customer will be refunded depends on the circumstances and the applicable rules. A website explains the process and never predicts an outcome.
Everyday enquiries continue alongside
They are covered in member questions credit unions answer every day and mortgage and lending enquiries routed correctly.
Tracking contact patterns helps
Volume and themes are worth reporting internally, as in reporting questions from marketing clients and how to report chatbot results to your boss.
Getting started
Publish your fraud route, what you never ask for and how to freeze a card, then show it first at any hour while every report goes straight to a person. SpideyChat for financial firms answers from your published pages and never collects account data. Try SpideyChat on your own site, or read about answers on the features page.