Treat urgency, credential requests and unexpected links as warning signs, even when a message appears to come from a bank, delivery firm or mobile provider.
Common signs
- Pressure to act immediately
- A link that does not match the organisation’s real domain
- Requests for passwords, PINs, full card details or one-time codes
- Unexpected QR codes or app-install instructions
- A sender name that hides an unfamiliar address or number
Verify independently
- Do not use the message link.
- Open the known official app or type the organisation’s address yourself.
- Use a trusted phone number from a statement or official site.
- Check whether the claimed event appears in the account.
If you clicked
- Disconnect from the suspicious page.
- Do not install profiles or apps.
- Change affected passwords from a clean device.
- Contact the bank immediately if money or card details are involved.
- Report the message or website.
UK text reporting
Most UK mobile users can forward suspicious texts to 7726 free of charge. Reporting does not replace contacting a bank or the police when loss or fraud has occurred.
A convincing message can still be false
Criminals may know your name, provider, recent purchase or delivery details. Correct personal information does not authenticate the sender. The decisive check is whether the request appears through the organisation’s independently opened official channel.
Judge the requested action, not the branding
A convincing logo, sender name or caller ID can be forged. Focus on whether the message creates urgency and asks for a sign-in, payment, remote-access app, one-time code or transfer to a “safe account”.
- Open the organisation’s official app or type its known address independently.
- Do not use the phone number or link contained in the suspicious message.
- Report suspicious UK texts to 7726 where supported and use the relevant official fraud route.
- If credentials were entered, change them from a clean device and review sessions immediately.
Preserve screenshots and transaction details when money or account access is involved, but do not continue engaging with the sender to collect more evidence.
Official sources
Facts checked: 26 July 2026. Menu paths, safety features, account procedures and network support can change. Recheck the current instructions for the exact device, software version, account and mobile provider before acting.
