Phishing is a message that pretends to be someone you trust, so that you hand over your details or your money yourself. It works on smart people every day, because it catches you when you're busy.
- Real banks, HMRC and delivery firms never ask for your PIN, password or one-time code, and never ask you to move money to a "safe account".
- Don't tap the link or call the number in the message. Go to the app, or a number you already trust, yourself.
- Been caught? Call your bank straight away on 159. Speed is what gets money back.
Figures for the 2026/27 tax year · last checked 2026-10-09
How it works
Every phishing message has the same three parts:
- A name you trust. Your bank, HMRC, Royal Mail, your boss, your mum.
- A reason to hurry. A payment has been blocked, a parcel is about to be returned, your account will be closed today.
- A simple next step. Tap this link, call this number, read me the code we just sent you.
The hurry is the whole trick. It's there to stop you thinking for the ten seconds it would take to spot the fake.
The ones you'll actually see
| What it says | What's really going on |
|---|---|
| "We couldn't deliver your parcel. Pay £1.45 to rebook." | The fee is bait. The page collects your card details. |
| "This is your bank's fraud team. Move your money to a safe account." | There is no such thing as a safe account. It's the scammer's account. |
| "HMRC: you are due a tax refund. Claim here." | HMRC doesn't text or email you a link to claim a refund. |
| "Hi Mum, I've dropped my phone, this is my new number." | A stranger who will shortly need money for an urgent bill. |
| A QR code stuck on a parking machine | A sticker over the real one, leading to a fake payment page. |
| "Read me the code we just texted you." | That code approves a payment or a login. Whoever has it is you. |
Phone calls count too. Scammers can make a call or text show your bank's real name or number, and it can even land in the same thread as genuine messages. The name on the screen proves nothing.
The 10-second checks
- Did I expect this? A surprise message about money is suspicious by default.
- Is it rushing me? Real organisations give you time. Scammers can't afford to.
- Is it asking for something secret? PINs, passwords and one-time codes are never needed by the person who contacts you.
- Can I check another way? Close the message. Open the app yourself, or call the number on the back of your card.
Worked example
A text arrives: "Evri: we missed you. Rebook your delivery for £1.45" with a link. You are waiting for a parcel, so it feels real.
Don't tap it. Open the retailer's app or the tracking email you already had, and check the parcel there. If there's nothing wrong, the text was fake. Forward it to 7726 and delete it.
Hang up and call 159. If someone rings claiming to be your bank or the police, end the call and dial 159. It connects you to your bank's real fraud team. Most major UK banks are signed up. If yours isn't, use the number on your card.
If you've already been caught
It happens to careful people. Don't let embarrassment slow you down, because the first hour matters most.
- Call your bank now on 159 or the number on your card. They can freeze cards and try to stop or recall a payment.
- Change the password on any account you typed details into, and anywhere else that shares that password.
- Report it to Report Fraud, the national service that replaced Action Fraud, online or on 0300 123 2040. In Scotland, call Police Scotland on 101.
- Watch for round two. Scammers often call back pretending to be the bank or a "recovery" firm that can get your money back for a fee.
Will I get my money back?
Often, yes, but it depends on what happened.
- Someone used your card or account without you. This is an unauthorised payment, and your bank must normally refund it.
- You were tricked into sending a bank transfer yourself. Since October 2024, banks must refund most of these, up to £85,000 per claim, usually within five working days. They can keep an excess of up to £100, and can refuse if you ignored clear warnings or were seriously careless. You have 13 months to claim.
- Not covered by that rule: payments sent abroad, crypto, cash, and gift cards. That's why scammers ask for them.
If your bank says no and you think that's wrong, complain to them, then take it to the Financial Ombudsman Service. It's free.
Report the fakes
Reporting takes seconds and gets numbers and websites shut down.
- Scam texts and calls: forward the text to 7726 (it's free).
- Scam emails: forward to report@phishing.gov.uk.
- Fake HMRC messages: forward emails to phishing@hmrc.gov.uk and texts to 60599.
Make yourself a harder target. Use a different password for your email than for anything else, turn on two-step verification, and agree a family code word for any "I need money urgently" message.