Phishing emails, texts and calls

Phishing is a fake message designed to make you click a link, open an attachment, or hand over personal and banking details. When it arrives by text it's called "smishing", and by phone "vishing".

Common examples

• Missed delivery: "Your parcel couldn't be delivered, pay a £1.45 redelivery fee."
• Your bank: "A new device has logged in. If this wasn't you, click here."
• HMRC or government: "You're due a tax refund." "Your energy rebate is ready."
• Subscriptions: "Your streaming account is suspended, update your payment details."
• Unpaid bills: road tolls, parking fines, TV licence and phone bills.

Our guide to parcel fees, parking fines and tax refunds explains how each organisation really contacts you, so you can tell the fakes apart. Want to see the real thing? Browse our gallery of phishing emails sorted by bank, with the giveaways marked.

How to spot a phishing message

• Unexpected: you weren't expecting a parcel, refund or warning.
• Urgent or threatening: "within 24 hours", "account will be closed", "final notice".
• The link looks wrong: press and hold (phone) or hover (computer) to see the real address. Look for misspellings, extra words or unusual endings like .top, .xyz or .info.
• Generic greeting: "Dear customer". Note that some scams do use your real name.
• Asks for details: card numbers, passwords, PINs or one-time codes.
• Small payment request: a tiny fee is often a way to steal your card details.

Modern phishing can look perfect, with correct logos, no spelling mistakes and even your name. If in doubt, don't use the message at all. Go to the company's website or app yourself.

What to do with a phishing message

• Text messageForward to 7726Free. Then delete it.
• Emailreport@phishing.gov.ukForward it, then delete it.
• WebsiteReport to NCSCHelps get it taken down.
• Scam callText 7726Send "Call" then the number.

If a phishing message got your password, read hacked email, WhatsApp or social media: what to do. If it got a one-time passcode, read passcodes, app approvals and screen sharing.

Most banks also accept phishing reports. Check your bank's website for its address, rather than a list on another site, as they change.

If you clicked a link or entered details

1. If you entered bank or card details, call your bank on 159 now.
2. If you entered a password, change it straight away, and on any other account where you've used it.
3. If you downloaded something, run a security scan and see malware advice.
4. Watch out for follow-up calls "from your bank" about the phishing. Criminals use what they collected to sound convincing.
5. If you lost money, see what to do if you've been scammed.

Last reviewed: October 2026