Scams are pressure games. The story changes, but the aim is consistent: get you to move faster than you normally would. These habits make you harder to rush, harder to steer, and harder to clean out.
Habits that do most of the work
1) Two-step anything money-related. If it is unexpected and money-related, you do not do it in one step. Pause, then verify using a route you choose.
2) No logins from links in messages. Even if the link looks perfect. Use the official app or type the address yourself.
3) Treat your email like the master key. Password resets flow through email. Lock it down properly.
A useful default line: “I’m going to stop here and contact the organisation directly using the official number.”
Verify safely
Verification means you build your own route. Do not use numbers or links provided inside the message.
Bank calls and “fraud alerts”
Stop the conversation. Open your banking app. Call back using the number in the app or on your card. In the UK, you can also use 159 if your bank supports it.
Ask: “Can you confirm whether there is any real issue on my account, and whether you contacted me today?”
Missed parcel texts
Do not use the link. Check whether you actually have a delivery coming. Use the retailer order page or the official courier app. Use the tracking number you already had, not one introduced by a text.
HMRC and tax messages
Do not use the link. Go to GOV.UK and navigate to HMRC from there. Check messages inside the account, not via email.
Marketplace buyers and sellers
Keep payment inside the platform where possible. Ignore screenshots as proof of payment. For collections, do not hand over the item until money is confirmed in your account.
Lock down the reset keys
You do not need perfect security. You need the basics done properly.
Email first
Change your email password, turn on 2-step verification, review forwarding and filter rules, check recovery details, and sign out of unknown devices.
Reduce password reuse
A reused password turns one incident into a week of account resets. A password manager makes unique passwords doable, especially for email, banking, and Apple ID or Google.
Turn on alerts
Enable banking alerts for transactions, transfers, new payees, and logins from a new device.
Mobile account security
Ask your mobile provider about an account PIN or password to reduce SIM swap risk.
Quick reference table
For the moments where you just want the safest default.
| If this happens | The safer default |
|---|---|
| Unexpected bank call or text | Hang up or stop replying. Call back via app or number on card. |
| Link asks you to log in | Do not use it. Type the URL yourself or use the official app. |
| Delivery text asks for a small fee | Check your actual orders and tracking through the retailer. |
| Marketplace payment screenshot | Ignore it. Confirm cleared funds in your account. |
| “New number” family emergency | Verify by calling the old number or using a check question. |
| Asked for an OTP or security code | Never share it. Call the bank yourself. |
If you think you’ve already been scammed, use the emergency playbook.
If you want to sense-check a message first, use the quick scam checker.
You can also go back to the Scam Shield hub.