How to tell if an email is a scam

Already clicked something? Go to what to do if you clicked a scam link.

Five quick checks

1. Who really sent it?

The display name at the top can say anything, so look at the email address behind it.

On a computer, hover over or right-click the sender's name to see the full address. On a phone, you may need to tap the sender's name before the full address appears.

Scam addresses often use random letters and numbers, or a web address that has nothing to do with the company. Watch for small differences, like an extra word or a swapped letter in the company name.

HMRC, for example, says it will only email you about a tax rebate, or ask for personal or payment details, from an address ending in hmrc.gov.uk.

2. Where do the links really go?

On a computer, hover your mouse over a link without clicking to see the address it leads to. On a phone this is fiddly and easy to get wrong, so don't try — go to the company's app or website yourself instead.

If the address doesn't match the company's real website, don't go there. Even if it does look right, it is safer to type the company's address yourself or use its app.

3. What is it asking you to do?

Be suspicious of any email that asks you to:

• log in through a link to "confirm", "verify" or "unlock" your account
• update your bank or card details
• pay an unexpected bill, fine or fee
• open an attachment you weren't expecting

The National Cyber Security Centre (NCSC) says your bank, or any other official source, will never ask you to send personal information by email.

4. Is it pushing your buttons?

The NCSC lists five tricks scammers use:

1. Authority — pretending to be your bank, a solicitor, your doctor or a government department.
2. Urgency — "within 24 hours" or "immediately".
3. Emotion — making you panic, fearful, hopeful or curious.
4. Scarcity — tickets, money or a cure that is in short supply.
5. Current events — tying in with the news or times of year like tax deadlines.

5. Does anything else look off?

Which? suggests checking for:

• a greeting that doesn't use your name ("Dear customer")
• blurry or pixelated logos
• mixed fonts, sizes and styles
• spelling and grammar mistakes — though many scam emails are now well written
• an email that works hard to tell you how "official" it is

Attachments

Which? warns that some scam emails carry malicious software that can infect your computer, tablet or phone. Don't open an attachment unless you were expecting it and you know who sent it.

If a friend or colleague sends something odd, check with them another way — a text or a call — before opening it. Their account may have been taken over.

How to check if an email is real

1. Don't click anything in the email.
2. Open a new tab and type the company's address yourself, or use its official app.
3. Log in there. If there really is a message or a problem, you will see it.
4. If you need to call them, use a number from their website, a bill or the back of your card — not from the email.

You can also paste the details into our Scam Check.

How to report a scam email

Forward it to report@phishing.gov.uk. The NCSC looks at everything sent there.

• The NCSC analyses what you send and can work with hosting companies to take down the websites it links to.
• It says it acts on every message received, though it can't tell you the outcome.
• You can report as many as you like, and report emails that only feel suspicious.
• There's no need to report emails already caught in your spam or junk folder.

If forwarding gives you an error, you can report the link on the NCSC's scam website reporting form (opens in a new tab).

If it claims to be from HMRC, you can also forward it to phishing@hmrc.gov.uk.

If you've replied, clicked or lost money

• Gave a password: change it straight away, and change it anywhere else you used it. Start with your email account.
• Gave bank details: call your bank on 159 or the number on the back of your card.
• Lost money or been hacked: report it to Report Fraud, the service that replaced Action Fraud: reportfraud.police.uk (opens in a new tab) or 0300 123 2040. In Scotland, call Police Scotland on 101.

Make yourself a harder target

• Protect your email account first. Use a strong password you don't use anywhere else, and turn on two-step verification. See what two-factor authentication is.
• Use passkeys where offered. The NCSC now recommends passkeys over passwords wherever a service supports them, partly because they resist phishing.
• Check what you share online. The NCSC notes that criminals use information you post publicly to make their emails more convincing.

Sources

• Report a scam email — National Cyber Security Centre (opens in a new tab)
• How to spot a scam email, text message or call — National Cyber Security Centre (opens in a new tab)
• Phishing scams: If you've shared sensitive information — National Cyber Security Centre (opens in a new tab)
• Passkeys: what you need to know — National Cyber Security Centre (opens in a new tab)
• Avoid and report internet scams and phishing — GOV.UK (opens in a new tab)
• Report suspicious HMRC emails, texts, social media accounts and phone calls — GOV.UK (opens in a new tab)
• How to spot an email scam — Which? (opens in a new tab)
• Stop, hang up, call 159 — Stop Scams UK (opens in a new tab)

Last checked: 22 September 2026