Scam help, in plain English

Hover over the link (or long-press on mobile) to preview the real address. Look for misspellings, extra words, unusual endings (.shop, .top), or a padlock next to an odd web address (the padlock only means the connection is private, not that the site is real). When in doubt, don't click, search for the company name in your browser and go to the site directly.

Urgency ('act in 24 hours'), threats (fines, account closure), unexpected refunds or parcels, requests for codes or passwords, and pressure to switch channels (move to WhatsApp, install an app). Real organisations rarely combine urgency with secrecy.

Scammers use unrealistic discounts, prizes or investment returns to bypass your judgement and trigger fast action. If a deal only exists via a link in a message, not on the brand's actual website, treat it as fake.

Yes, this is called spoofing. Caller ID, sender names and even reply-to addresses can be forged. Never trust a contact just because it 'looks' right. Hang up and call the organisation back on a number from their official website or the back of your card.

If you didn't enter any details, you're likely fine, close the tab and run a scan with your device's built-in security (Windows Security, macOS XProtect, or your phone's protection). If you entered a password, change it immediately on every account that uses it and turn on two-step verification.

Call your bank using the number on the back of your card straight away. Change the affected password and any others that share it. Turn on two-step verification. If it was a work account, tell your IT team straight away, because acting fast limits the damage.

Disconnect from the internet, then turn the device off. From a different device, change passwords for banking, email and any accounts you use on that machine. Run a full antivirus scan, and consider a factory reset if you stored anything sensitive. Contact your bank to flag accounts.

No. Any reply confirms your number or email is active and invites more scams. Don't click 'unsubscribe' on suspicious emails either, block the sender and report it instead.

Usually, yes. Since October 2024, UK banks must refund most people tricked into sending money by bank transfer (Faster Payments or CHAPS), and most refunds are made within five working days. Tell your bank as soon as you can, and within 13 months of the last payment.

Section 75 of the UK Consumer Credit Act makes your credit card provider jointly responsible with the seller when you pay by credit card for a single item costing over £100 and up to £30,000. If goods don't arrive or aren't as described, you can claim from the card company even if the seller refuses. Debit card purchases use the separate 'chargeback' scheme.

A chargeback lets your card provider try to reverse a payment if the seller didn't deliver, the item was faulty, or you were a victim of fraud. It applies to debit and credit cards. Contact your bank, explain what happened, and provide any evidence (receipts, screenshots, messages). Most schemes give you 120 days.

After being scammed, you may be contacted by people claiming they can recover your money for an upfront fee. This is almost always a second scam targeting the same victim. Legitimate recovery only happens through your bank, the police, or formally appointed solicitors, never via cold calls or social media DMs.

Forward suspicious texts to 7726 (free on every UK network, it spells SPAM). Report scam calls to the same number by texting the caller's number. Report scam emails by forwarding them to report@phishing.gov.uk.

If you've lost money, had your identity stolen, or been the victim of any cyber-enabled fraud in England, Wales or Northern Ireland, report it to reportfraud.police.uk or call 0300 123 2040. Report Fraud replaced Action Fraud in December 2025, the number is unchanged. In Scotland, call Police Scotland on 101. Report even if no money was lost, it builds the picture.

Report to the Federal Trade Commission at reportfraud.ftc.gov, and to the FBI's Internet Crime Complaint Center at ic3.gov. For identity theft specifically, use identitytheft.gov, which generates a personal recovery plan.

Yes, if you shared any account details, gave a one-time code, or gave remote access. Banks can flag the account for monitoring and may issue new cards or reset online banking, blocking attempts before they happen.

Two-step verification (also called 2FA or MFA) adds a second check, usually a code from an app or text, when signing in. Even if a scammer has your password, they can't get in without that second step. Turn it on for email, banking and social media first. Authenticator apps are safer than SMS where available.

Have a 'check with me first' rule for any unexpected request for money, codes or remote access, no judgement, just a quick call. Add their number to the Telephone Preference Service, set up call blocking on their phone, and review bank statements together monthly. Our Feel Safer Online pathway is designed for this.

Yes, by a wide margin. A reputable password manager (1Password, Bitwarden, Apple Passwords, Google Password Manager) creates strong unique passwords for every site, fills them in only on the real domain, and warns you about reused or breached passwords. See our password managers guide for setup help.

Share examples, real screenshots beat warnings in the abstract. Run our free online safety check together and walk through the recommendations. For schools, families and community groups, our Scam Alerts page sends weekly real-world examples you can talk through.