This page is for the moment where something feels off and you want a quick, sensible next step. Use it to slow things down and verify safely without guessing.
Fast triage (30 seconds)
Answer these three questions. If any are “yes”, treat it as high risk and verify through an official route.
Strong scam signals
You do not need to tick every box. One or two strong signals is enough to stop and verify independently.
It tries to keep you inside the message or call
It gives you a link or a number and wants you to stay there. Real organisations are fine with you hanging up and calling back via the number on your card, your banking app, or the official site you type in yourself.
It asks for things real organisations do not need
A bank does not need your one-time code. A delivery company does not need your card details to “release a parcel”. If you are asked for codes, remote access, or payments to resolve a problem, treat it as high risk.
It introduces a new destination for money
“Transfer to a safe account”, “pay a fee”, “buy gift cards”, “send crypto”, “refund requires a payment first”. Real refunds do not start with you paying money out.
It uses urgency plus a threat
“Your account will be closed”, “police are involved”, “final notice”, “you will be arrested”. Threat plus urgency is designed to stop you checking.
It isolates you
“Do not tell anyone”, “do not hang up”, “stay on the line while you do it”. Legitimate organisations do not need isolation.
Reality checks you can do quickly
These are simple checks that cut through the story.
Are you even a customer?
If you do not have an account with the bank, service, or platform they mention, you can stop there.
Do you actually have an order coming?
Delivery scams rely on autopilot. If nothing is due, you do not need to investigate further.
Does the contact method make sense?
Banks do not move security issues to WhatsApp. HMRC does not handle account problems via random text links. A “support agent” asking to move to Telegram is usually the point.
Does the request match the normal process?
If they are asking you to do something you have never had to do before, treat it as suspicious until confirmed through an official route.
What to do next
Pick the path that matches what happened.
Nothing has happened yet
Stop replying. Screenshot the message and sender. Verify independently through the app, card number, or official site you type in.
You clicked a link and entered details
Change the password for that account. If you reused it anywhere else, change those too. Secure your email first.
You shared a code or gave remote access
Treat it as urgent. Call your bank fraud team using the number on your card or in your app.
You sent money
Call your bank fraud team immediately. Ask if the payment is pending and whether it can be stopped or recalled.
Quick table: the safest default
If you are unsure, use the “safer default” column.
| Message or situation | Safer default |
|---|---|
| Unexpected bank call or text | Hang up or stop replying. Call back via your banking app or the number on your card. |
| Link asks you to log in | Do not use it. Type the URL yourself or use the official app. |
| Delivery text asks for a small fee | Check your actual orders and tracking through the retailer, not the text. |
| Marketplace buyer sends a payment screenshot | Ignore it. Only treat it as paid when funds are in your account. |
| “New number” family message asking for money | Verify by calling the old number or using a check question. |
| Asked for an OTP or security code | Never share it. Call the organisation via an official route. |
UK quick contacts
Official routes. If you are unsure, use these rather than anything in the message.
Bank impersonation calls
Hang up and call 159 if supported by your bank. It connects you to your bank safely (participating banks).
Report Fraud (Action Fraud)
Report online or call 0300 123 2040 for reporting and advice (England, Wales, Northern Ireland). Scotland: Police Scotland via 101.
Report phishing
Email: report@phishing.gov.uk (NCSC). Texts: forward to 7726 (free).
If you think you’ve been scammed, use the emergency playbook.
For prevention habits, read scam-resistant money habits.
Or go back to the Scam Shield hub.