BeginnerSpotting Scam Emails & Texts

Check the actual email address, not just the name

Scammers can make an email appear to come from "HMRC Refunds" or "Royal Mail Delivery" in your inbox — but the actual sending address will give them away.

In your email client, click or tap on the sender name to reveal the full email address. A genuine HMRC email will come from @hmrc.gov.uk. A genuine Royal Mail email will come from @royalmail.com. If the address is something like hmrc-refund@taxgov.support or royal-mail-delivery@parceltracking.net, it is a scam.

This one check will catch the majority of phishing emails.

Also watch for subtle misspellings: amaz0n.com, paypa1.com, or hmrc.gov.uk.tracking-portal.com (the real domain here is tracking-portal.com, not hmrc.gov.uk).

When in doubt, don't click the link in the email. Instead, open your browser and type the organisation's address directly — for example, gov.uk for HMRC or royalmail.com for Royal Mail.

More in Spotting Scam Emails & Texts

All guides

beginnerfeatured

Delivery companies never ask for redelivery fees by text

One of the most common scam texts in the UK pretends to be Royal Mail, Evri, DPD, or another delivery company, telling you a package is held and you need to pay a small fee — usually £1.50 to £3 — to release it. Royal Mail, Evri, DPD, Amazon Logistics, and DHL do not send texts asking you to pay for redelivery by clicking a link. Any such text is a scam. If you enter your card details on the fake site, the scammers capture your full card number, expiry, and CVV. The small charge goes through, but so do much larger unauthorised charges later. If you are genuinely expecting a delivery and receive one of these texts, ignore the text and instead go directly to the delivery company's official app or website to check your delivery status. Track your Royal Mail parcels at royalmail.com, not through any link in a text message. Forward suspicious texts to 7726 — this is the UK's free spam SMS reporting service. It takes five seconds.

See: The Royal Mail Missed Parcel Text ScamSpotting Scam Emails & Texts

beginner

Pause before you act on any urgent message

The defining feature of almost every scam — whether email, text, phone call, or social media message — is urgency. Criminals create pressure because they know that when you're panicking, you stop thinking carefully. "Your account will be closed in 24 hours." "Payment required today to avoid legal action." "This is your final notice." "Your computer is infected and you must act now." When you feel this kind of pressure from an unexpected message, that is the single strongest signal that you should slow down rather than speed up. Most genuine organisations — banks, HMRC, utility companies — do not demand you act within minutes or hours. Real deadlines come with days or weeks of notice and are communicated through multiple channels. Building the habit of pausing for five minutes before acting on any urgent communication — and using that time to verify through official channels — will prevent the majority of scams from succeeding.

See: The Fake Bank Security AlertSpotting Scam Emails & Texts

beginnerfeatured

Banks will never ask you to move money to a "safe account"

If anyone calls you and asks you to transfer your money to a different account to protect it from fraud — even if they appear to be calling from your bank's genuine phone number — hang up immediately. This is a scam called an Authorised Push Payment fraud or "safe account scam," and it accounts for hundreds of millions of pounds stolen from UK victims every year. Your bank will never ask you to: - Transfer money to a different account to keep it safe - Share your full card number or PIN over the phone - Withdraw cash and hand it to a courier - Download an app so they can "monitor" your account Phone numbers can be faked (called "spoofing"), so a call appearing to come from your bank's genuine number could still be a criminal. If you receive such a call, hang up, wait at least 5 minutes (criminals sometimes stay on the line to intercept your next call), then call your bank using the number on the back of your card. Since October 2024, UK banks are legally required to reimburse most APP fraud victims under the new Payment Systems Regulator rules. Know your rights.

See: The Fake Bank Security AlertSpotting Scam Emails & Texts