How to spot a scam email, text message or call
Scam messages are designed to make you react quickly. They might say your bank account is at risk, a parcel could not be delivered, a payment has failed, or a family member urgently needs help. The details change, but the goal is usually the same: make you click a link, call a number, install something, send money, or hand over a code.
The safest habit is simple: slow the moment down. If a message makes you feel rushed, worried or embarrassed, treat that feeling as a warning sign rather than a reason to act faster.
Common warning signs
Urgency: “Act now”, “account blocked”, “final notice” or “payment due today”. Real organisations may send reminders, but scammers push hard because pressure stops people checking.
Unexpected links: A text or email that asks you to sign in through a link is risky. Open the official website or app yourself instead of using the link in the message.
Requests for codes or passwords: A genuine bank, Microsoft, Apple, courier or government department should not ask you to read out one-time passcodes, passwords or full banking details.
Odd sender details: Look for spelling mistakes, strange email addresses, slightly wrong web addresses, or messages that do not sound like the organisation normally writes.
Remote access pressure: Be very cautious if someone on the phone wants you to install AnyDesk, TeamViewer, Quick Assist or similar software. Remote tools can be legitimate, but scammers use them to take control.
What to do before clicking
Do not use the link or phone number in the message. Go to the organisation’s website by typing the address yourself, use the official app, or call a number from a card, statement or official website.
If the message claims to be from a bank, courier, HMRC, PayPal, Microsoft, Apple or a utility company, check through the normal route you already trust. If it is real, it will usually appear there too.
If a caller says there is a fraud or security problem, hang up and call back using a trusted number. If it involves your bank, wait a few minutes or use another phone before calling, just to be safe.
If you already clicked or replied
Do not panic. The right next step depends on what happened. If you only opened a link and closed it, the risk may be low. If you entered a password, banking detail or one-time code, change the password from a trusted device and contact the relevant organisation quickly.
If you installed software or allowed remote access, disconnect the device from the internet and get help before using online banking or important accounts again.
Useful official guidance
The National Cyber Security Centre has good advice on spotting and reporting phishing messages. Action Fraud is the UK reporting route for fraud and cyber crime.