Use this guide when a message asks you to click a link, pay, confirm details or act urgently, or when you want to prepare your household before it happens. You only need the suspicious message and a few minutes; do not click anything in it yet.
Step by step
Pause and look for pressure
Scam messages try to rush you with threats of account closure, missed deliveries, fines, refunds or prizes. Stop before doing anything and ask whether you were expecting this message. Genuine organisations will not mind you taking time to check.
Check the sender and link
Look at the full sender email address or number, not just the display name, and watch for small misspellings. On a computer, hover over a link without clicking to see where it really goes. If the address does not clearly belong to the organisation, treat it as a scam.
Verify through a trusted route
Contact the organisation using a number or app you already trust, such as the number on the back of your bank card or the official app. Never use phone numbers or links provided in the suspicious message. For calls, hang up and ring back from a different phone if possible, or wait a few minutes first.
Report the message
Forward suspicious texts free of charge to 7726, which spells SPAM on a keypad, so your mobile network can block the sender. Forward scam emails to the National Cyber Security Centre's Suspicious Email Reporting Service, whose address is listed on GOV.UK. Report fake adverts or websites through the reporting options on those platforms.
Delete and block
Once reported, delete the message and block the sender or number. Do not reply, even to say stop, as this confirms your number or address is active. Tell family members about the scam so they recognise it too.
Act fast if you responded
If you gave a password, change it at once on the real site and anywhere you reused it, and turn on 2-step verification. If you shared bank or card details or sent money, call your bank immediately using a trusted number. Then report it to Report Fraud (formerly Action Fraud), or to Police Scotland on 101 if you live in Scotland.
Ready-to-use checklist
- Paused before clicking or replying
- Checked the real sender address or number
- Checked where links actually lead
- Contacted the organisation through a trusted route
- Texts forwarded to 7726
- Emails forwarded to the NCSC reporting service
- Sender blocked and message deleted
- Bank called and Report Fraud (formerly Action Fraud) report made if money or details were shared
Practical tips
- Banks and the police will never ask you to move money to a safe account, so treat any such request as a scam.
- Agree a family password to use if someone claims to be a relative in trouble asking for money by text.
- Keep bookmarks for your bank, delivery firms and key accounts so you never need to use links in messages.
Common problems
The message looks exactly like my bank's real messages.
Criminals copy logos and wording, and can even make texts appear in the same thread as real ones. Ignore the link and check your account in the official app or by calling the number on your card. If there is a genuine problem, it will show there.
I already entered my card details on a fake delivery page.
Call your bank straight away using the number on your card and ask them to block the card. Watch your statements for unfamiliar payments and report the scam to Report Fraud (formerly Action Fraud) or Police Scotland. Be alert for follow-up calls pretending to be your bank's fraud team.
An elderly relative keeps receiving scam calls.
Ask their phone provider about free call-blocking services and register with the Telephone Preference Service to cut down legitimate marketing calls. Agree that they will never act on a call without speaking to you first. Their bank may also offer extra protections for vulnerable customers.