How to spot scam messages

What a scam message is

A scam message is a text, email, WhatsApp or social media message pretending to come from someone you trust, such as your bank, a delivery company, a government office or a family member. Its aim is to get your money, your passwords or your personal details. When it arrives by email it is often called phishing, as in "fishing" for information. By text message it is sometimes called smishing.

Scammers send millions of these messages. They only need a few people to fall for them, so do not feel silly if one looks convincing. Some are very good.

The warning signs

Most scams use the same few tricks. Learn these and you will spot the majority:

• Urgency or fear. "Your account will be closed today", "Pay now to avoid a fine", "Your parcel will be returned".
• Something you did not expect. A prize you never entered, a refund you did not request, a parcel you are not waiting for.
• A request for codes or passwords. No real bank or company will ever ask for your full password, PIN or the one-time code they just sent you.
• A link to "confirm your details". The link leads to a fake website that copies the real one.
• Unusual ways to pay. Gift cards, cryptocurrency, or a bank transfer to a "safe account".
• A new number claiming to be family. "Hi Mum, I dropped my phone, this is my new number" followed by a request for money.
• Too good to be true. Huge discounts, easy investment profits, or a job that pays well for very little work.

Tip: Spelling mistakes used to be a giveaway. Today criminals use AI to write perfect messages, so good grammar proves nothing.

Checking links and senders

A web address is like a postal address: the important part is the main name just before the first single slash. In www.mybank.com/login the real site is mybank.com. In mybank.com.secure-login.net the real site is secure-login.net, which is not your bank at all.

• On a computer, hover over a link without clicking to see where it really goes.
• Look at the full email address of the sender, not just the name shown. A name is easy to fake.
• Be wary of shortened links, which hide the real address.

But the safest habit is simpler: do not use the link at all. Open your banking app or type the company's address yourself.

What to do with a suspicious message

1. Do not click, reply or call any number in it. Even replying "STOP" tells the scammer your number is active.
2. Check independently. Log in through the official app, or call the number on the back of your card or on the company's official website.
3. For "family" messages, call the person on the number you already have, or ask a question only they would know.
4. Report it. In the UK you can forward scam texts to 7726 for free and phishing emails to the National Cyber Security Centre. Many other countries have similar services, and email apps have a "report phishing" button.
5. Delete it once reported.

If you already clicked or replied

Do not panic, and do not feel ashamed. Act quickly:

• If you gave bank or card details, call your bank straight away using the number on your card. They can block payments.
• If you entered a password, change it at once on the real website, and anywhere else you used the same one. See hacked account: what now?
• If you downloaded something, run a security scan and consider asking someone you trust for help.
• Turn on 2-step verification for important accounts. Our guide shows how: turn on 2-step verification.
• Report it to the police or your national fraud reporting service, especially if you lost money.

Want the technical version? Read our note on phishing basics.