Back to all tips

How to spot a scam email or text

By Tim · 13 October 2026

Scammers want you to act before you think. These checks take a few minutes and catch most scams.

Free to read and print. If it helps you, there is a way to say thanks at the bottom of the page.

1. Is it rushing you?

"Your account will be closed today." "Your parcel will be returned." "Act now." Real banks and shops do not panic you. If a message makes your heart race, stop and breathe before you do anything.

2. Is it asking for something private?

Your bank will never ask for your PIN, your full password or a one-time code by email, text or phone. Neither will the tax office or the police. Nobody genuine will ask you to move your money to a "safe account".

3. Does the sender look right?

Look at the actual email address, not just the name. A message from "Your Bank" can come from an address that has nothing to do with your bank. On a phone, press and hold the name to see the address behind it.

A scammer's trick is to copy an address you have seen before, with a small change. It looks familiar at a quick glance, but a closer look shows it is fake. For example, joebloggs@gmail.com might become joebloggsgmail@something-else.com.

4. Fake payment requests ("my bank isn't working")

Scammers often email to say something like:

"My bank app/online banking isn't working right now. Can you please send the payment via PayPal instead?"

Do not send money until you have checked it is really them, using a phone number you already know.

The same goes for invoices. If an email arrives with an invoice, or with bank details that have changed, ring the person on a number you already know before you pay. That includes me: I will never email you asking you to pay a PayPal invoice or a payment link. Here is how I take payment.

5. PayPal: three golden rules

• Check the name before you send. When you enter an email or handle in PayPal, it always shows the real full name of the account holder on the final confirmation screen, before you press send.
• If you do not know and trust the name, do not press send. Cancel the payment straight away.
• Never use "Friends and family" for purchases. Scammers often ask for it so you lose PayPal's Buyer Protection. Stick to "Goods and services" when paying for an item, or better still, refuse if you do not know the person.

If something looks wrong on your PayPal account

Contact PayPal through its own app, or by signing in at paypal.com and using Help. It has options to report unauthorised access, unknown charges, and phishing or suspicious emails. Never ring a number or click a link that came in an email or text.

Have your transaction ID ready

1. Sign in at paypal.com, or open the official PayPal app.
2. Go to Activity (or History).
3. Open the suspicious payment or transfer to see the details.
4. Find the 17-character transaction ID (a mix of numbers and letters, for example 1AB23456CD789012E).
5. Write it down, so you can read it out if PayPal asks.

6. Do not use the links in the message

Instead, close the message and go to the company yourself: type their website into your browser, use their official app, or ring the number on the back of your card. If the problem is real, it will show up there.

7. Telephone bank scams

Scammers use "number spoofing" to make their call look like your bank's real number on your phone's display. They pretend there is urgent fraud on your account and try to rush you into:

• moving money to a "safe account" (banks never have safe accounts)
• giving away your card PIN, online passwords or security codes
• installing remote access software on your computer

The golden rule

If anyone calls claiming to be from your bank or PayPal about a security problem, stop and hang up.

A real bank will never mind if you hang up to check. Only a scammer will try to keep you on the line or panic you.

A safety tip for landlines

If you use a traditional landline, wait at least 5 minutes after hanging up, or ring a friend first to make sure the line has cleared. Scammers can sometimes stay connected after you put the phone down, to make you think you have made a new call. Using a mobile to dial 159 avoids this risk.

8. You never need to install anything to open an email, a PDF or a website

Your computer, phone and tablet already have everything built in: a web browser (Safari on Apple devices, Edge on Windows, or Chrome if you already use it) and a way to open PDFs.

• If an email, pop-up or website says you must install a new browser, a "PDF viewer", a "player" or an "update" to open something, it is a scam. Close it and do not click anything. For example, I recently found unwanted programs called "Wavesor" and "SWUpdater" on a customer's computer, along with a "browser" called Wave. It had come by email, installed itself, and allowed outside access.
• Do not open attachments or download programs from emails you were not expecting.
• On the phone: scammers also ring pretending to be your bank, your broadband company, Microsoft or the police. They ask you to install an app, often a remote access app such as AnyDesk, TeamViewer or RustDesk, which lets them see and control your screen, including your online banking. If anyone asks, hang up.
• If you have already installed something: turn off your Wi-Fi or unplug the internet cable straight away. Then ring your bank on the number on your card, from a different phone if you can. Do not log in to your bank on that computer until it has been checked. I can check it for you.

9. Never give out personal information to someone who contacted you

If somebody rings, texts or emails you first, do not give them personal information, however friendly or official they sound. That includes your date of birth, your address, your full card number, your PIN, your passwords and any code sent to your phone. A real company already has what it needs, and will let you ring it back on a number you trust.

10. When in doubt, ask someone

It is never silly to ask. Show a family member, a neighbour, or me before you click. Forwarding a suspicious email to report@phishing.gov.uk helps to get scam sites shut down, and you can forward a suspicious text to 7726, which is free.

If you have already clicked or paid

• Ring your bank straight away on the number on your card, or dial 159, which connects you to many UK banks. The sooner you call, the better the chance of stopping a payment.
• Change the password of the account involved, and of any other account that uses the same one.
• Do not be embarrassed. Clever people get caught, because scams are designed by professionals. What matters is acting quickly.
• If you would like a hand, book a visit or ring me on 07746 655324. I can check your accounts and your computer, and help you work out who to contact. I cannot promise that lost money will come back.

Download the printable PDF (2 pages, 55KB) (opens in a new tab)