To report a phishing scam in the UK, forward suspicious emails to report@phishing.gov.uk, forward scam texts to 7726, and report scam websites to the National Cyber Security Centre (NCSC). If you have lost money, call your bank straight away (you can dial 159) and report the crime to Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland, or to Police Scotland on 101. This guide explains how to spot a phishing message, where to report each type of scam as of October 2026, and what to do if you have already clicked.
What is phishing?
Phishing is when criminals pretend to be someone you trust, such as your bank, a delivery firm, HMRC or a friend, to trick you into clicking a link, opening an attachment, handing over personal details or sending money. It arrives by email, text message, phone call, social media, messaging apps and even fake adverts. The goal is usually to steal passwords, card details or cash, or to install malicious software on your device.
How to spot a phishing scam
The NCSC says scam messages tend to lean on the same few psychological tricks. Learning to recognise them is the best defence, because modern scams are often well written and look convincing.
- Authority: the message claims to come from an official body such as a bank, doctor, solicitor or government department.
- Urgency: you are told to act within hours or face a fine, a blocked account or another penalty.
- Emotion: it tries to make you panicked, hopeful or curious, for example with a threat, an unexpected refund or a teaser you feel you must click.
- Scarcity: it offers something in short supply, such as concert tickets, cheap goods or a miracle cure, so you fear missing out.
- Current events: it piggybacks on the news, big events or seasonal deadlines such as tax returns to seem expected.
The golden rule: stop and check independently
If a message makes you uneasy, stop and break contact before doing anything. Do not use the phone number, link or email address in the message. Instead, contact the organisation using details from its official website, a bank card or a paper statement. The NCSC stresses that official organisations will not ask for personal information by email, and that your bank will not ask you to confirm your account details over the phone.
Be wary of QR codes in emails too. They can hide a link to a fake website, and the NCSC advises extra caution when one turns up unexpectedly in your inbox.
Where to report a phishing scam in the UK
If you have not lost money or replied, reporting the message still helps. It allows the authorities to block senders and take down fake websites before others are caught. The routes below are those listed by the government’s Stop! Think Fraud campaign and the NCSC as of October 2026.
Scam emails
Forward the email to report@phishing.gov.uk, then delete it. This goes to the NCSC’s Suspicious Email Reporting Service, which analyses reported messages and can block sender addresses or work with hosting companies to remove malicious websites. The NCSC does not reply with the outcome of individual reports.
Scam text messages
Forward the text to 7726. You may receive a reply asking for the sender’s phone number, which you can send back to complete the report.
Scam phone calls
Send a text to 7726 with the word “Call” followed by the number that rang you.
Messaging apps and social media
Block the number or account and use the app’s own reporting feature.
Scam websites
Use the NCSC’s online “report a scam website” form. Avoid clicking around the site or entering any information while you check it. If the dodgy link came in an email or text, report the message itself through the email or text routes above.
Scam adverts
Report misleading or fake online adverts to the Advertising Standards Authority (ASA), and to the platform where you saw them.
Scam post and HMRC scams
Royal Mail takes reports of scam letters through an online form or on 0800 011 3466. Messages pretending to be from HMRC can be forwarded to phishing@hmrc.gov.uk (emails) or 60599 (texts).
More Read
If you have lost money: Report Fraud, not Action Fraud
Many older guides still mention Action Fraud. That service has been replaced. According to the City of London Police, Report Fraud took over as the national service for reporting fraud and cyber crime in England, Wales and Northern Ireland on 4 December 2025, with a full public launch following in January 2026. The phone number, 0300 123 2040, stayed the same.
If you have been scammed out of money, act in this order:
- Call your bank or payment provider immediately. Use the number on its website or the back of your card, or call 159.
- Report the crime. In England, Wales and Northern Ireland, use reportfraud.police.uk or call 0300 123 2040. In Scotland, call Police Scotland on 101.
- Tell the organisation that was impersonated, and the platform where the scam took place.
If you or someone else is in immediate danger, call 999.
What to do if you clicked a link or shared details
Clicking a phishing link is not the end of the world, but speed matters. The NCSC recommends these steps:
- Shared bank or card details? Contact your bank straight away.
- Typed in a password? Change it, and change it anywhere else you used the same password. Where a service offers a passkey, switch to one.
- Opened an attachment or installed something? Run a full scan with your antivirus software and let it fix anything it finds.
- Think an account has been taken over? Look for messages you did not send or check whether you have been locked out, then follow the account provider’s recovery process.
- Got the message on a work device? Tell your IT team.
How to make yourself a harder target
Criminals use details you post publicly, such as your employer, birthday or recent holiday, to make their messages more believable. The NCSC suggests limiting what you share online and reviewing the privacy settings on your social media accounts. Turning on two-step verification, using a password manager and adopting passkeys where possible all reduce the damage if you are ever caught out.
Fraud remains a priority for policymakers, from the UK ban on the “SIM farms” used to blast out scam texts to a fraud strategy shaped by the threat of AI. But reporting by the public is still one of the main ways fake websites and phone numbers get shut down.
Frequently asked questions
Is Action Fraud still running?
No. Report Fraud replaced Action Fraud on 4 December 2025 as the service for reporting fraud and cyber crime in England, Wales and Northern Ireland. Use reportfraud.police.uk or call 0300 123 2040. In Scotland, report to Police Scotland on 101.
How do I report a scam phone call?
Text 7726 with the word “Call” followed by the number that called you. Scam texts can be forwarded to the same number, and scam emails to report@phishing.gov.uk.
Will I get a reply after reporting a phishing email?
Usually not. The NCSC analyses reports to block senders and remove malicious websites but does not respond to individual reports. Its reporting service is not the place to report a crime; for that, use Report Fraud or Police Scotland.
What if a scam message claims to be from my bank?
Do not reply or use any contact details in the message. Call your bank using the number on its website or your card, or dial 159. Banks will not ask you to confirm your account details over the phone.
Sources: HM Government Stop! Think Fraud, Reporting fraud (updated 29 May 2026); National Cyber Security Centre, How to spot a scam email, text message or call (accessed October 2026); National Cyber Security Centre, Report a scam website (accessed October 2026); National Cyber Security Centre, Phishing scams: if you’ve shared sensitive information (accessed October 2026); City of London Police, Report Fraud service goes live (4 December 2025); techUK, Report Fraud service replaces Action Fraud (9 December 2025).
