How to Spot and Report a Phishing Text in the UK

A text arrives from an unknown number. It claims to be your bank, a delivery firm, or HMRC. It says there's a problem, a parcel waiting, or a refund due — and it needs you to act now. Millions of these messages are sent across the UK every day, and they are designed to catch you at exactly the wrong moment: tired, busy, distracted, or worried.

The good news is that phishing texts follow patterns. Once you know what to look for, they become much easier to spot. And if one does slip through, reporting it takes less than a minute. Here's how to handle them properly.

What a Phishing Text Actually Is

Phishing is when someone pretends to be a person or organisation you trust in order to get something from you. In a text message, that usually means one of three things: your bank details, your personal information, or your money directly.

The message might claim to be from your bank warning of suspicious activity. It might pose as Royal Mail or a courier saying a parcel can't be delivered. It could pretend to be HMRC offering a tax rebate, or a streaming service saying your payment failed. Some simply say "Hi Mum, I've broken my phone, this is my new number" and ask for money.

What they all share is a sense of urgency. That pressure is not accidental. It is the entire mechanism of the scam.

Signs You're Looking at a Scam

No single warning sign proves a message is fake, but two or three together should stop you in your tracks.

• An unexpected sender. If you weren't expecting a message from that company, treat it with suspicion. Genuine organisations rarely cold-text you about account problems.
• A link you're told to click. Banks and government departments do not send texts asking you to click through and confirm details. They direct you to log in through their official app or website instead.
• Urgency and threats. "Your account will be suspended within 24 hours." "Failure to pay will result in legal action." Real organisations do not operate this way over SMS.
• A different number or odd formatting. Scam messages often come from mobile numbers rather than short codes, or from a sender name that looks slightly off. Check carefully for misspellings.
• Requests for personal details. Passwords, PINs, full card numbers, one-time passcodes, or your mother's maiden name. No legitimate bank will ever ask for these by text.
• Poor spelling and grammar. Not always — some scams are well written — but errors and awkward phrasing are still a useful clue.

If a message claims to be from your bank and you're genuinely unsure, stop. Open your banking app directly or call the number on the back of your card. Never use the contact details in the text.

How to Report a Scam Text to 7726

7726 is the UK's national reporting service for spam and scam texts. The number spells "SPAM" on a phone keypad, and it is free to use on all major UK networks.

Here's the process:

1. Don't click anything. Do not tap links, call numbers, or reply to the message.
2. Forward the text to 7726. Open the message, select forward, and send it to 7726 as if it were a normal text.
3. Wait for a reply. You'll usually get an automated response asking for the number the message came from.
4. Send the sender's number. Reply with the phone number or sender ID exactly as it appeared.
5. Delete the message. Once reported, remove it from your phone.

Reporting helps your network provider and the National Cyber Security Centre investigate and block similar campaigns. It won't always get an instant response, but it does feed into the systems that shut these operations down.

If You've Already Clicked or Replied

Don't panic, but do act quickly. If you entered bank details, contact your bank immediately using the number on the back of your card or via their app. If you gave away a password, change it — and change it anywhere else you've used the same one. If you think you've lost money, report it to Action Fraud, the UK's national reporting centre for fraud and cybercrime.

Protecting Your Bank Details

Prevention is mostly about habits rather than technology.

Treat every unexpected text as suspicious until proven otherwise. If a message says it's from your bank, ignore the link and log in through your app. Turn on two-factor authentication wherever it's offered, and never share the one-time codes it generates with anyone — not even someone claiming to be from the bank itself. Genuine staff will never ask for them.

Consider setting up transaction alerts through your banking app so you're notified of payments as they happen. If something looks wrong, you'll know straight away rather than at the end of the month. You can also check whether your email or phone number has appeared in a known data breach using the Have I Been Pwned service, which is free and widely used.

If you're ever unsure whether a message is genuine, the safest move is always the same: stop, don't engage, and contact the organisation through a channel you've looked up yourself.

A Few Final Habits Worth Building

Scam texts work because they arrive when you're least expecting them and ask you to act before you think. Slowing down is the single most effective defence. Read the message twice. Ask yourself whether you were expecting it. Check the sender. If anything feels off, it probably is.

Talk to family members who might be less familiar with these tactics, particularly older relatives who may be targeted more often. A five-minute conversation can save a lot of trouble later.

And if you do get caught out, report it. Shame keeps people quiet, and silence is exactly what scammers rely on. Reporting to 7726, your bank, and Action Fraud helps protect you and everyone else on the same network.