How to spot a phishing email in the UK, and what to do next

A message arrives that looks like it is from your bank, a government department or a delivery firm. It asks you to act. Phishing works because it is built to make you click before you think. This guide follows the advice of the National Cyber Security Centre (NCSC), the UK body whose public pages cover how to recognise, report and respond to scam messages. It adds nothing from outside those pages.

What phishing messages look like

Cyber criminals may contact you by email, text, phone call or social media. They will often pretend to be someone, or an organisation, you trust.

The NCSC points out that scams used to be easier to spot. They might contain bad spelling or grammar, come from an unusual email address, or feature imagery or design that feels "off". But scams are getting smarter, and some even fool the experts. So the absence of obvious mistakes is not a sign that a message is safe.

The NCSC also says criminals are increasingly using QR codes within phishing emails to trick people into visiting scam websites. It advises you to be wary of scanning QR codes within emails.

The five tell-tale signs

Scammers try to quickly gain your trust, and they aim to pressure you into acting without thinking. If a message or call makes you suspicious, the NCSC's advice is to stop, break the contact, and consider the language it uses. Scams often feature one or more of these signs.

Authority

Is the message claiming to be from someone official, such as your bank, doctor, a solicitor or a government department? Criminals often pretend to be important people or organisations to trick you into doing what they want.

Urgency

Are you told you have a limited time to respond, such as "within 24 hours" or "immediately"? Criminals often threaten you with fines or other negative consequences.

Emotion

Does the message make you panic, fearful, hopeful or curious? Criminals often use threatening language, make false claims of support, or tease you into wanting to find out more.

Scarcity

Is the message offering something in short supply, like concert tickets, money or a cure for medical conditions? Fear of missing out on a good deal or opportunity can make you respond quickly.

Current events

Are you expecting a message like this? Criminals often exploit current news stories, big events or specific times of year, such as tax reporting, to make their scam seem more relevant to you.

How to check a message is genuine

If you have any doubts, contact the organisation directly. Do not use the numbers or address in the message. Use the details from the organisation's official website.

The NCSC adds that your bank, or any other official source, will never ask you to supply personal information via email, or call and ask you to confirm your bank account details. If you suspect someone is not who they claim to be, hang up and contact the organisation directly. If you have paper statements or a credit card from the organisation, official contact details are often written on them.

Criminals use information about you that is available online, including on social media, to make their phishing messages more convincing. The NCSC says you can reduce the likelihood of being phished by thinking about what personal information you and others post about you, and by reviewing your privacy settings on your social media accounts. Remove Me offers a free analysis with no account needed. It searches publicly visible web results, known public data breaches (Have I Been Pwned) and a register of data brokers, then shows a report unlocked by a 6-digit code sent by e-mail. It does not yet send erasure requests on your behalf.

How to report a scam email

If you have received an email you are not quite sure about, the NCSC asks you to forward it to its reporting address, which is given on its page. A few points from the NCSC:

• You can forward as many suspicious emails as you like.
• Send emails that feel suspicious even if you are not certain they are scams, because the NCSC can check.
• Do not click on any links in a suspicious email.
• You do not need to forward suspicious emails you find in your spam or junk folder.

The NCSC explains why reporting matters. The purpose of a scam email is often to get you to click a link, which can take you to a website that might download a virus to your computer, or steal passwords or other personal information. The NCSC has the power to investigate and remove scam email addresses and websites. It says reporting is free, and that by reporting you can reduce the amount of scam emails you receive, make yourself a harder target for scammers and protect others from cyber crime online.

What happens after you report

The NCSC analyses the suspect email and any websites it links to. If it discovers activity it believes is malicious, it may work with hosting companies to remove links to malicious websites, and raise awareness of commonly reported suspicious emails and methods through partners. It cannot tell you the outcome of its review, but it says it acts upon every message received.

If your email is rejected

You might get an error message when you forward something. The NCSC says this does not mean the service is broken. If your email contained only one link, the error means it has already been recognised as spam. If it contained more than one link, you could try sending separate emails each containing one link, or submit each link individually through the NCSC's suspicious website reporting form.

If you have already responded

The NCSC sets out what to do depending on what happened:

• You provided your banking details: contact your bank and let them know.
• You think an account has been hacked: for example if you see messages sent from your account that you do not recognise, or you are locked out, follow the NCSC guidance on recovering a hacked account.
• You received the message on a work laptop or phone: contact your IT department and let them know.
• You opened a link on your computer, or followed instructions to install software: open your antivirus software if you have it, run a full scan, and let it clean up any problems it finds.
• You gave out your password: change the passwords on any of your accounts which use the same password. If available, you could use a passkey instead.
• You have lost money: tell your bank and report it as a crime to Report Fraud (England, Wales and Northern Ireland) or Police Scotland (Scotland).

Reporting a crime is a separate step

The NCSC is clear that you should not report a crime to it by forwarding a scam email. If you think you may have been a victim of fraud or cyber crime and live in England, Wales or Northern Ireland, report it to Report Fraud at reportfraud.police.uk or by calling 0300 123 2040. If you live in Scotland, call Police Scotland on 101.

The NCSC also lists separate reporting routes for scam text messages, websites, phone calls and adverts. The pages used for this article do not describe those routes in detail, so go to the NCSC site for them.

In short

• Scams pressure you. Look for authority, urgency, emotion, scarcity and current events.
• Check by contacting the organisation through its official website, not through the message.
• Forward suspicious emails to the NCSC and do not click their links.
• If you have acted on a message, follow the steps above that match what you did.
• Crimes and losses go to Report Fraud or Police Scotland, not to the NCSC's email address.

The Remove Me team.