Phishing Scams in the United Kingdom
UK phishing campaigns impersonate HMRC, Royal Mail, NHS, and high-street banks with sophisticated SMS and email attacks that exploit PAYE tax deadlines, parcel delivery seasons, and NHS appointment confirmations.
Part of: Phishing
Last reviewed: 1 June 2026
The United Kingdom consistently ranks among the most phishing-targeted nations globally, with HMRC, Royal Mail, and major banks such as Barclays, Lloyds, NatWest, and HSBC among the most impersonated brands. The NCSC's Suspicious Email Reporting Service (SERS) receives millions of forwarded phishing emails each year, and the service has taken down tens of thousands of scam sites since its launch.
SMS phishing in the UK exploits the trusted relationship Britons have with institutions they deal with regularly — tax, healthcare, and banking — and the technical ability to spoof legitimate SMS sender IDs means fake messages often appear alongside genuine ones.
How this scam works on United Kingdom
HMRC phishing peaks around self-assessment deadlines (January) and PAYE code updates (April), claiming recipients are entitled to a tax refund or owe an unpaid tax balance. The linked page captures bank details framed as necessary to receive the refund.
Royal Mail phishing runs continuously throughout the year and intensifies in the run-up to Christmas, with fake delivery notification SMS messages that include a link to pay a small customs or redelivery fee.
Banking phishing in the UK frequently uses 'account suspension' messaging — claiming that the victim's account has been flagged for security reasons and must be verified via a link — often appearing in the same SMS thread as genuine bank messages due to sender ID spoofing.
Common red flags
- HMRC SMS or email claiming a tax refund is available and requires bank details to process
- Royal Mail SMS about a parcel held for a customs or redelivery fee
- Bank SMS appearing in a legitimate message thread asking for verification via a link
- NHS appointment confirmation email with a link to a survey offering a reward
- Any government or bank communication creating urgency with a deadline
How to protect yourself
- Forward suspicious SMS to 7726 (SPAM) for network investigation
- Forward phishing emails to [email protected] (SERS)
- Access HMRC only through gov.uk/hmrc — never through links in messages
- Enable two-step verification on your online banking
- Check takedown status of reported phishing sites at ncsc.gov.uk
How to report it
- Forward phishing emails to [email protected]
- Forward phishing SMS to 7726
- Report to Action Fraud at actionfraud.police.uk if you provided personal or financial details
Frequently asked questions
Does HMRC ever contact people about tax refunds by SMS?
HMRC does send some SMS messages but does not include links to claim refunds or enter bank details. To check for a genuine HMRC communication, log into your Personal Tax Account at gov.uk/personal-tax-account directly. All HMRC text messages can be checked at gov.uk/government/organisations/hm-revenue-customs/contact/check-a-tax-form-notification-or-letter.