How to Spot a Phishing Scam: Emails, Texts and Calls
Learn the warning signs of phishing emails, scam texts and fake calls, and what to do in the UK if you think you've been targeted.
Phishing is when a criminal pretends to be someone you trust (your bank, a delivery firm, HMRC, a streaming service) so you'll hand over passwords, card details or money. It's one of the most common ways people get scammed, and it works because the messages look real. The good news is that most scams share the same handful of warning signs.
The five warning signs
- Urgency or fear. "Your account will be closed today", "You've missed a delivery, pay now", "A warrant has been issued". Scammers rush you so you don't stop and think.
- A link or attachment you weren't expecting. The real goal is to get you onto a fake login page or to open a file that installs malware.
- A request for information a real company already has. Your bank will never ask for your full PIN or password, or ask you to move money to a "safe account".
- A sender address or number that's slightly off. Look for misspellings like paypa1 or royalmail-redelivery-uk.info. The display name can say anything; it's the address behind it that counts.
- Something that's too good to be true. Unexpected refunds, prizes, crypto profits or "you've been selected" offers.
Check a link without clicking it
On a computer, hover your mouse over a link and the real web address appears at the bottom of the window. On a phone, press and hold the link to preview it. Look at the part just before the first single slash: in https://login.barclays.co.uk/... the real site is barclays.co.uk, but in https://barclays.co.uk.secure-login.net/... the real site is secure-login.net, which is not your bank.
Scam texts ("smishing")
Fake parcel, toll, parking-fine and bank texts are extremely common. Real companies rarely send a link asking you to pay a small fee. If in doubt, contact the company using details from its official website, not the number in the text.
Phone scams ("vishing")
Callers may already know your name or the last digits of your card, which makes them sound convincing. If someone claiming to be your bank or the police calls you, hang up, wait a few minutes (or use a different phone), and call the number on the back of your card. A genuine organisation will never mind you doing this.
How to report scams in the UK
- Emails: forward suspicious emails to
[email protected], the National Cyber Security Centre's reporting service. - Texts: forward scam texts free of charge to 7726, which lets your mobile network block the sender.
- Websites: you can report scam websites through the NCSC website.
What to do if you've already clicked
- If you entered a password, change it straight away, and change it anywhere else you used the same one.
- If you gave bank or card details, call your bank immediately using the number on your card. Speed matters.
- Turn on two-step verification for your email and important accounts (see our password guide).
- Run a security scan. On Windows, open Windows Security and choose a quick scan.
- Report it so others can be protected.
Being caught by a scam is nothing to be embarrassed about. These messages are made by professionals. Acting quickly is what limits the damage.