Phishing Scams in the United Kingdom
UK phishing campaigns impersonate HMRC, Royal Mail, NHS, and high-street banks with sophisticated SMS and email attacks that exploit PAYE tax deadlines, parcel delivery seasons, and NHS appointment confirmations.
Part of: Phishing
Last reviewed: 1 June 2026
The United Kingdom consistently ranks among the most phishing-targeted nations globally, with HMRC, Royal Mail, and major banks such as Barclays, Lloyds, NatWest, and HSBC among the most impersonated brands. The NCSC's Suspicious Email Reporting Service (SERS) receives millions of forwarded phishing emails each year, and the service has taken down tens of thousands of scam sites since its launch.
SMS phishing in the UK exploits the trusted relationship Britons have with institutions they deal with regularly — tax, healthcare, and banking — and the technical ability to spoof legitimate SMS sender IDs means fake messages often appear alongside genuine ones.
How this scam works on United Kingdom
HMRC phishing peaks around self-assessment deadlines (January) and PAYE code updates (April), claiming recipients are entitled to a tax refund or owe an unpaid tax balance. The linked page captures bank details framed as necessary to receive the refund.
Royal Mail phishing runs continuously throughout the year and intensifies in the run-up to Christmas, with fake delivery notification SMS messages that include a link to pay a small customs or redelivery fee.
Banking phishing in the UK frequently uses 'account suspension' messaging — claiming that the victim's account has been flagged for security reasons and must be verified via a link — often appearing in the same SMS thread as genuine bank messages due to sender ID spoofing.
Common red flags
- HMRC SMS or email claiming a tax refund is available and requires bank details to process
- Royal Mail SMS about a parcel held for a customs or redelivery fee
- Bank SMS appearing in a legitimate message thread asking for verification via a link
- NHS appointment confirmation email with a link to a survey offering a reward
- Any government or bank communication creating urgency with a deadline
How to protect yourself
- Forward suspicious SMS to 7726 (SPAM) for network investigation
- Forward phishing emails to [email protected] (SERS)
- Access HMRC only through gov.uk/hmrc — never through links in messages
- Enable two-step verification on your online banking
- Check takedown status of reported phishing sites at ncsc.gov.uk
How to report it
- Forward phishing emails to [email protected]
- Forward phishing SMS to 7726
- Report to Action Fraud at actionfraud.police.uk if you provided personal or financial details
Frequently asked questions
How can I verify whether an HMRC or Royal Mail text is genuine?
HMRC will never ask for payment or personal details via text link, and Royal Mail redelivery fees, if genuinely owed, are handled through their official website — not a link in an unsolicited SMS. Check the URL carefully for subtle misspellings of the real domain before entering any information. If unsure, go directly to the official gov.uk or royalmail.com site rather than clicking the message link.
Where do I report phishing texts and emails in the UK?
Forward phishing texts to 7726 and suspicious emails to [email protected], both of which feed into national efforts to block similar scams. If you've lost money, report it to Action Fraud, the UK's national fraud reporting centre, and contact your bank immediately. Reporting helps build the case against ongoing campaigns even when individual recovery isn't possible.
I entered my bank details on a fake NHS or bank page — what should I do first?
Contact your bank immediately using the number on the back of your card (not any number from the suspicious message) and ask them to monitor or freeze the account. Change your online banking password and enable additional security features if available. Report the incident to Action Fraud and to the NHS or bank being impersonated so they're aware of the ongoing campaign.
Does HMRC ever contact people about tax refunds by SMS?
HMRC does send some SMS messages but does not include links to claim refunds or enter bank details. To check for a genuine HMRC communication, log into your Personal Tax Account at gov.uk/personal-tax-account directly. All HMRC text messages can be checked at gov.uk/government/organisations/hm-revenue-customs/contact/check-a-tax-form-notification-or-letter.