SUVAT
Published 1 March 2025 Guidance

Recognising and reporting suspicious emails, texts and calls

Plain English guidance for individuals on how to identify phishing emails, scam text messages (smishing) and fraudulent phone calls (vishing), and what to do if you receive one.

1. What is phishing?

Phishing is a type of fraud where criminals send messages designed to trick you into revealing personal information, clicking on a malicious link or downloading harmful software. These messages may arrive by email, text message (sometimes called "smishing") or phone call ("vishing"). They often pretend to be from organisations you trust — your bank, a delivery company, HMRC, or even a government body.

Phishing is one of the most common forms of cyber crime in the United Kingdom. SUVAT receives tens of thousands of reports each month from members of the public.

2. How to spot a suspicious email

Not all phishing emails are obvious. Some are highly convincing and closely imitate genuine messages. However, most share some common warning signs:

2.1 Check the sender's address

Look carefully at the email address, not just the display name. A message may appear to come from "Royal Mail" but the actual email address might be something like royalmail-delivery@random-domain.com. Genuine organisations will send from their official domain.

2.2 Look for urgency and threats

Phishing emails frequently try to create a sense of panic. Common tactics include:

  • "Your account will be suspended within 24 hours unless you verify your details."
  • "You have an unpaid tax bill. Pay immediately to avoid legal action."
  • "Unusual activity has been detected on your account. Click here to secure it."

Legitimate organisations will not threaten you with immediate consequences or pressure you into acting without thinking.

2.3 Examine links before clicking

Hover your mouse over any link in the email (without clicking) to see where it actually leads. On a mobile device, press and hold the link. If the web address does not match the organisation the email claims to be from, do not click it.

2.4 Watch for poor grammar and formatting

While not always the case, many phishing emails contain spelling mistakes, unusual formatting or inconsistent branding. Compare the email with genuine messages you have received from the same organisation.

2.5 Unexpected attachments

Be cautious of any unexpected attachment, even if it appears to be a PDF, Word document or spreadsheet. These files can contain malware. If you were not expecting the attachment, do not open it.

3. How to spot suspicious texts and calls

3.1 Scam text messages

  • Messages claiming you have a parcel to collect, a tax refund to claim or an outstanding payment to make.
  • Links to websites that look like a bank or government service but are not the genuine site.
  • Requests to call a phone number you do not recognise.

3.2 Scam phone calls

  • A caller claiming to be from your bank, the police or a government department, asking you to transfer money, provide account details or grant remote access to your computer.
  • Callers who insist you must not tell anyone about the call or who become aggressive when challenged.
  • Calls using a spoofed number that appears to be genuine — remember that caller ID can be faked.
Remember: Your bank, the police and government departments will never ask you to transfer money to a "safe account", share your full password or PIN, download software to give them remote access to your computer, or keep the conversation secret.

4. Common scams currently circulating

SUVAT regularly monitors the most prevalent scams targeting UK residents. As of early 2025, the following types are particularly widespread:

  • HMRC tax refund scams. Emails and texts claiming you are owed a tax refund and asking you to enter bank details on a fake website.
  • Delivery notification scams. Messages purporting to be from Royal Mail, DPD, Evri or Amazon, claiming a parcel could not be delivered and asking you to pay a redelivery fee.
  • Energy rebate scams. Emails claiming you are entitled to a government energy payment, directing you to a fraudulent form.
  • NHS and health service scams. Messages offering free health screenings, COVID booster appointments or prescription services that lead to phishing sites.
  • Subscription renewal scams. Emails claiming your antivirus, streaming service or cloud storage subscription is about to renew at an inflated price, prompting you to call a number to "cancel".

5. How to report

5.1 Suspicious emails

Forward suspicious emails to report@phishing.gov.uk. The NCSC's Suspicious Email Reporting Service analyses reports and works to take down malicious websites.

5.2 Suspicious text messages

Forward scam text messages to 7726. This free service is provided by your mobile phone operator. The number 7726 spells "SPAM" on a phone keypad.

5.3 If you have lost money or provided personal details

  1. Contact your bank immediately if you have made a payment or shared financial details.
  2. Report the incident to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040.
  3. If you believe your identity has been stolen, contact the UK's fraud prevention service, CIFAS, to place a protective registration on your record.

5.4 Reporting to SUVAT

You can report suspicious activity to SUVAT using the form on our website. While SUVAT does not investigate individual cases of fraud, the reports you submit help us understand the threat landscape and issue timely warnings to the public.

6. Protecting yourself

  • Use strong, unique passwords for each of your online accounts. Consider using a password manager.
  • Turn on two-factor authentication wherever it is available. See our separate guidance on setting up two-factor authentication.
  • Keep your devices, operating systems and applications up to date.
  • Be sceptical of any unsolicited contact asking for personal or financial information, regardless of how legitimate it appears.