A familiar name lowers doubt
The message may borrow a delivery, tax, banking, health, subscription or account story so that the contact feels ordinary before the request is examined.
Technology, platforms and channels
Current scam campaigns and impersonation alerts
A scam campaign is a repeated approach delivered through calls, messages, email, adverts, websites or social accounts. The names and stories change, but the request, route and intended outcome often reveal the underlying process.
Page T-006Guidance pageReviewed 29 August 2026
Key Guidance
Do not decide whether a contact is genuine from the organisation named in it. Check what you are being asked to do, leave the supplied route and verify the situation independently.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
Campaigns can spread quickly, change wording and imitate organisations that people already expect to hear from. A warning about one version helps, but understanding the shared structure protects you when the next version looks different.
The same campaign crosses channels
A text can lead to a website, a website to a call and a call to a payment or account action. Each step can appear to confirm the previous one.
Real events provide convincing cover
Outages, deadlines, public announcements and data breaches can be reused by people who have no connection with the genuine event.
Reports do not identify every variation
Numbers, sender names, domains and wording can change rapidly. The absence of an exact public warning does not make the contact safe.
Consequences and movement
What may happen next
The first contact is usually designed to move you somewhere else. Follow the movement: what must you disclose, install, approve or pay for the story to continue?
A supplied link captures information
A lookalike page may request login details, card information, identity evidence or a small payment that appears routine.
A call takes control of verification
The caller may tell you which number to use, keep you on the line or claim that ordinary security procedures must be bypassed.
Access becomes the next target
Remote-access software, one-time codes, account resets or device settings may give the criminal a route into accounts or payments.
A second contact exploits the first
After information or money is taken, another person may pose as an investigator, bank or recovery service and request another fee or disclosure.
Practical response
What you should do
You do not need to prove who sent the contact before protecting yourself. Break the supplied route, preserve the evidence and use a channel you choose.
- Pause before following the instructionDo not use the link, call-back number, QR code, download or payment details while the sender controls the situation.
- Name the actual requestWrite down whether the contact wants information, money, a code, a download, secrecy, urgency or a change to a familiar process.
- Verify outside the contactOpen the official app or type the known website address yourself. Use a saved number or a number from an independent source.
- Preserve and report the approachKeep the full message, sender details, link, number and time. Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726.
- Respond to what you didIf you disclosed details, entered a password, installed software or paid, secure the affected account or device and contact the relevant provider at once.
- Expect a follow-upDo not assume a later caller is genuine because they know about the first contact. Reuse the same independent verification process.
Look more closely
Scam stories change faster than the underlying request
Names, organisations and current events can change from one campaign to the next. Looking beyond the story to the requested action, destination and transfer of value makes recurring patterns easier to recognise.
A call, message, advert, search result or post creates access.
Urgency, curiosity, fear, reward or responsibility makes the contact matter.
A recognised organisation, role or current event supplies borrowed trust.
The sender controls the link, number, account, download or next conversation.
Payment, sign-in details, identity evidence, access or approval is requested.
Selected history
Historical cases and lasting lessons
Public-health and support impersonation
Phishing campaigns reused public-health announcements, testing, grants and financial support as the story attached to malicious messages and websites.
Lasting lesson: A genuine public programme does not authenticate the route contained in an unexpected message.
Delivery and account-message variations
Campaigns repeatedly use missed items, small fees, expiring access and security warnings because these situations are common and demand a quick response.
Lasting lesson: Test the requested action and independently open the real service. Do not wait for an exact match to a published warning.
Transferable understanding
Patterns over time
Small requests can open larger paths
A low fee or simple form may be used to capture card details, sign-in details or a willing contact rather than to make the final gain at once.
Authority and urgency often travel together
The impersonated role supplies permission while a deadline reduces the time available for independent checking.
Channel changes create false confirmation
Moving from message to call or website can feel like a second source even when one actor controls the whole journey.
Campaign labels are temporary
The transferable lesson is the repeated request and route, not the brand, number or wording used in one version.
Plain-language answers
Common questions
If I cannot find a warning about this exact message, is it genuine?
No. Campaigns change faster than public warning lists. Verify the organisation and request through a route that did not come from the message.
Does a real sender name prove who sent the text?
No. Display names and numbers can be imitated or spoofed, and messages may appear in an existing thread.
Should I click the link just to see where it goes?
No. Open the organisation’s known website or app independently. Report the supplied link without using it.
What if the message creates no urgency?
A slow, friendly or routine approach can still build a Path. Examine the eventual request and the route used to verify it.
Report the contact and respond to any action
Report suspicious communications through the channel-specific route. If information, access or money has already moved, contact the affected account provider, bank or organisation at once before completing a wider fraud report.
Scamology Insights
Learn to recognise the campaign beneath the wording
These apps, tools, books and courses can help you compare how different campaigns first make contact, create interest, claim an identity and direct the next action. A new name or message does not always need a new defence. Product links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency