How to Spot and Avoid UK-Specific Phishing Scams in 2025

It's a Tuesday morning and your phone buzzes: a text from "Royal Mail" saying a parcel is being held and a £2.25 redelivery fee is due. You weren't expecting anything, but you did order something last week, and the link looks fine. A card number, a code, and the money is gone — along with the details needed to try again.

UK-focused scams have become polished. The broken English and misspelt logos have largely gone. What's left is a near-perfect copy of gov.uk, a spoofed sender name sitting in the same text thread as your real bank, and enough urgency to stop you reading carefully. The upside is that these messages share habits. Learn the habits and most of them collapse in seconds.

Why UK-specific scams work so well

Generic phishing casts a wide net. Scams built for the UK hang on things we all deal with: tax deadlines, missed deliveries, energy rebates, council tax, TV Licensing, the DVLA, NHS appointments. The message arrives in the middle of real admin, so the request feels like something you already should have handled.

Two techniques do most of the work. The first is spoofing — the sender name is faked, so the text appears in an existing thread from your bank or arrives simply as "HMRC". The second is a cloned website: a page identical to the real sign-in screen, quietly sending your details elsewhere. The only dependable difference is the web address, which is why typing an address yourself beats trusting good design.

HMRC and other government lookalikes

HMRC does not text or email you out of the blue about a refund and ask you to claim it through a link. If you are owed money, you claim it after signing in to your Government Gateway account. Treat any message about a tax rebate, a "tax code error", an unpaid bill or immediate legal action as suspicious by default.

The same pattern turns up dressed as other officials: a council tax rebate, a cost of living payment that needs your bank details, a DVLA notice about unpaid vehicle tax, a TV Licensing email threatening a fine. When something is genuinely wrong, these organisations write to you by post — and they never ask for card details by text.

Two details worth memorising

• Genuine HMRC emails come from addresses ending in hmrc.gov.uk or gov.uk. Lookalikes such as hmrc-refund.co or gov-uk.support are private domains.
• Real government pages end in .gov.uk. Anything else is somebody's website wearing a government costume.

Parcel and delivery scams

Parcel fraud is the most common text scam in the UK, partly because the script is so easy to fall for. A delivery is held, a small fee is due, and you have 24 hours before it goes back. The fee is deliberately tiny — 90p, £2.25 — because nobody argues about small change.

Couriers do sometimes charge customs or handling fees, which is exactly why the fake works. Your response should be identical every time: don't pay through the link. Close the message, open the courier's website or app yourself, and enter the tracking number from your order confirmation. If the fee is real, it will be there waiting.

Small clues are usually present. The tracking number is missing or generic. The sender is a random mobile number rather than a shortcode. And no courier needs your full card details, expiry date and CVV to collect a pound.

Bank, payment and "safe account" scams

Bank scams are the most damaging, because sometimes the message is only the opening move. Two versions cause the most trouble.

Smishing with a spoofed sender

A text lands in your bank's thread warning of a suspicious payment, with a link to verify or cancel it. Freezing a card, approving a payment or confirming a new payee happens inside your banking app, or over the phone using the number printed on your card. Never through a link in a message.

The "safe account" call

Someone claiming to be from your bank's fraud team says your account is compromised and you need to move your money to a safe account they control. No UK bank will ever ask you to transfer money elsewhere to keep it safe. Not one, not ever. Hang up, then call the number on your card or your statement. If the caller asks you to keep the transfer quiet or gives you a reason to tell branch staff, that is the clearest sign of all.

Related rule: never read out a one-time passcode to anyone who contacts you, however convincing their reason.

Five checks that catch most of them

• Slow down at urgency. Deadlines, fines and "your account will be closed" exist to stop you checking.
• Read the address, not the display name. Expand it and look at what comes after the final dot.
• Never use the link. Open the app or type the address yourself.
• Compare with a contact detail you already hold — the card, a bill, a statement.
• Ask whether the organisation would really do it this way. HMRC doesn't text about refunds, banks don't ask you to move money, couriers don't need full card details for a small fee.

If you've clicked, replied or paid

1. Stop all contact. Don't reply, don't click again, and don't ring any number given in the message.
2. If money has gone, phone your bank at once using the number on your card. Recent payments can sometimes be recalled. Ask for the fraud team and note the reference. Banks are generally required to reimburse victims of authorised push payment fraud, subject to exceptions, so ask directly about your case rather than assuming either way.
3. Change passwords for your email, banking and anything mentioned in the message, and switch on two-factor authentication.
4. Check your credit report for searches or accounts you don't recognise, and query anything unexpected.
5. Report it. Forward suspicious emails to [email protected] and texts to 7726, which is free on any UK network. Report fraud to Action Fraud on 0300 123 2040 or via their website; in Scotland, contact Police Scotland. If a large sum is involved, your bank's fraud team is the first call and a solicitor may be worth speaking to.

Take screenshots before you delete anything — they help your bank and Action Fraud. Then block the sender, and tell the person most likely to fall for the same message: a parent, a neighbour, someone at work. UK scams run on a handful of scripts, and anyone who has heard the script once is much harder to catch twice.

Photo: Olha Ruskykh / Pexels