Pause
Do not click, reply, call its number, download a file or share a security code.
Check
Open the organisation’s official app or type its known website address yourself.
Protect
Contact the real organisation, secure affected accounts and report what happened.
Take the right next action.
I received it but did not respond
Forward a suspicious email to report@phishing.gov.uk. Forward suspicious texts to 7726. Then block the sender.
I clicked, but entered nothing
Close the page. Do not download or install anything. Watch accounts for unusual activity and run a security scan if something was installed.
I entered a password
Go directly to the real service and change it now. Change any other account using the same password and turn on two-step verification.
I shared bank details or lost money
Contact your bank immediately using its official app, card number or website. Ask it to stop payments and secure the account.
I shared a one-time security code
Contact the affected bank or service immediately. Treat the account as compromised even if no money has moved yet.
Act across every affected record.
- 1
Tell your bank, card provider or lender and challenge transactions or accounts you do not recognise.
- 2
Change passwords for email, banking and social accounts; secure your main email first.
- 3
Report lost identity documents to the issuing organisation and report stolen documents to the police.
- 4
Check your credit files with Experian, Equifax and TransUnion for searches or accounts you do not recognise.
- 5
Consider Cifas Protective Registration, a paid service that prompts participating organisations to make extra identity checks.