REPORT
Forward, then delete
Forward suspicious emails to report@phishing.gov.uk and texts to 7726. The NCSC says send ones that feel suspicious even if you are not certain, and don't click any links.
Where to report whatStart
WHAT THE GUIDANCE SAYS
Don't click.
Forward it.
Most people who want your password do not break in. They send an email and wait for you to click.
Phishing is the name for scam messages that try to get you to click a link, so a website can install a virus or take your passwords or personal details. This independent guide sets out what the UK's National Cyber Security Centre says about spotting them and reporting them.
STOPthen check
Find where to reportKeep in mind
- Pause before you click
- Check another way
- Report, don't reply
- One minute that protects others too
THE SHORT ANSWER
Not sure?
Send it on.
The NCSC would rather check an email that turns out fine
than miss one that steals someone's password.
THE SIGNS
Pressure is the giveaway
Scammers try to make you act without thinking. The NCSC lists five signs: authority, urgency, emotion, scarcity and current events.
Four habits
CHECK IT
Use the number you already have
If in doubt, contact the organisation directly using its official website or the details on a statement or card, never the number or address in the message.
See the numbersA QUICK REPORTING CHECK
What did you
receive?
Pick what has happened to see where the NCSC and GOV.UK say to report it. The bar shows how urgent it is to act.
For England, Wales and Northern Ireland unless stated. In Scotland, fraud and cyber crime are reported to Police Scotland on 101.
TWO NUMBERS WORTH KNOWING
Why one forward
makes a difference.
One number from the NCSC's takedowns,
one from the government's own survey.
454.8k
Scam URLs removed by the NCSC
The NCSC's running total as of July 2026. It has the power to investigate and remove scam email addresses and websites, and says it acts on every message it receives, though it cannot tell you the outcome.
TAKEDOWNS · NCSC
38%
Businesses hit by phishing in a year
Phishing remained the most common type of attack in the government's latest survey, reported by 38% of businesses and 25% of charities, as summarised by ICAEW in May 2026.
UK BUSINESSES · CYBER SECURITY BREACHES SURVEY
Reporting is free and the NCSC says it takes about a minute. It may share details with law enforcement partners such as the National Crime Agency and the City of London Police.
FOUR HABITS TO TRY
A harder target,
in four steps.
None of these needs technical skill. They come from the NCSC's advice for individuals and families.
Step 1
Stop and read the language
If a message makes you suspicious, stop, break the contact and look for authority, urgency, emotion, scarcity or a link to current events.
Step 2
Check it another way
Contact the organisation directly using its official website. Your bank will never ask for personal information by email or call to confirm your account details.
Step 3
Report it, then delete it
Forward the email to report@phishing.gov.uk and texts to 7726. It is free and helps the NCSC take scam sites down for everyone.
Step 4
Share less about yourself
Criminals use details you post online to make messages more convincing. The NCSC suggests reviewing your social media privacy settings.
SCAMS ARE GETTING SMARTER
Spelling mistakes
are not enough.
The NCSC says it used to be easier to spot scams by bad spelling, an odd email address or a design that felt off, but scams are getting smarter and some fool even the experts. That is why it focuses on how a message tries to make you feel and act.
It also warns that criminals increasingly hide QR codes inside phishing emails. QR codes in pubs and restaurants are usually fine, but be wary of scanning one in an email.
Questions
Questions on the way
Where do I send a phishing email in the UK?
Forward it to report@phishing.gov.uk. The National Cyber Security Centre analyses the email and any websites it links to, and can work with hosting companies to remove malicious sites.
Should I report an email if I'm not sure it's a scam?
Yes. The NCSC asks people to send emails that feel suspicious even if they are not certain they are a scam, because it can check them.
Will the NCSC tell me what happened to my report?
No. The NCSC says it cannot tell you the outcome of its review, but that it acts on every message it receives.
What if I clicked a link or lost money?
If you have lost money or been hacked after responding to a phishing message, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 in England, Wales or Northern Ireland, or to Police Scotland on 101.
How do I report a scam text?
GOV.UK says to forward suspicious text messages to 7726, which is free.
Destination