The tell-tale signs of phishing emails, texts and calls, how to check a message safely, where to report it in the UK, and what to do if you've already clicked or replied.
Phishing is when criminals send messages pretending to be from a trusted organisation, such as a bank, HMRC, a delivery firm or a streaming service, to trick you into clicking a link, giving personal details, or paying money. It is the most common way cyber attacks start, for individuals and businesses alike. Here is how to recognise it and what to do.
Common signs of a phishing message
- Urgency or threats: "Your account will be closed today", "Pay now to avoid a fine".
- A request for personal or financial details, passwords, or one-time codes. Your bank will never ask for your full PIN or password, or ask you to move money to a "safe account".
- Too good to be true: prizes, refunds or investment returns you weren't expecting.
- Odd sender details: an email address or phone number that doesn't match the organisation, or a display name that hides a different address.
- Links that don't look right: hover over a link (on a computer) to see where it really goes. Look for misspellings or extra words in the domain.
- Generic greetings such as "Dear customer", though some phishing uses your real name from leaked data.
- Unexpected attachments, especially zip files or documents asking you to "enable content".
Phishing is increasingly polished: spelling mistakes are less common than they used to be, and AI tools make convincing messages easier to write. Judge the request, not just the presentation.
Texts, calls and QR codes
- Smishing (SMS phishing): fake delivery, parking or toll texts with a link.
- Vishing (voice phishing): calls pretending to be your bank, the police or tech support. Caller ID can be faked.
- Quishing: fake QR codes, for example stuck on parking meters, leading to payment pages.
How do you check safely?
- Don't use the links, numbers or attachments in the message.
- Contact the organisation directly using details you trust: the number on your card, its official website or app.
- If someone calls you, hang up and call back on a known number, ideally from a different phone or after waiting a few minutes, as some scammers keep the line open.
- Take your time. Genuine organisations won't mind you checking.
How do you report phishing in the UK?
- Emails: forward them to [email protected], the NCSC's Suspicious Email Reporting Service.
- Texts: forward them free to 7726.
- Scam websites and adverts: report them through the NCSC website.
- If you've lost money or been hacked: report it to Report Fraud (which replaced Action Fraud in December 2025) at reportfraud.police.uk or on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101.
- Calls: report scam calls to your phone provider; dialling 159 connects you to many major UK banks.
If you've already clicked or replied
- If you gave bank details or made a payment, contact your bank immediately.
- If you entered a password, change it straight away on the real site, and anywhere else you use it. Turn on two-step verification.
- If you opened an attachment or installed something, run your security software, update your device, and consider getting it checked.
- Watch your accounts for unusual activity.
- Report it as above.
Reduce your risk
- Use a password manager: it won't fill in passwords on fake sites with the wrong address.
- Turn on two-step verification for email, banking and social media.
- Keep devices and apps updated.
- Be careful what you share publicly, which scammers use to personalise messages.
Frequently asked questions
Is it safe to open a phishing email?
Generally, simply opening it is low risk. Clicking links, downloading attachments or replying is where the danger lies.
Sources and further reading
- NCSC: Phishing scams, how to spot and report them
- Report Fraud
- NCSC: Top tips for staying secure online
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.