Public guidance
Scamology Guidance Library
The Guidance Library helps you understand a suspicious situation and choose what to do next. Start with your situation, search for a topic or browse by subject.
Follow a guided route in order, search the full collection or browse the four Subject Areas.
01
Start with your situation
What brought you here?
Choose a guided route when you want a clear reading order. Each route begins at step 1 and carries the same colour, step number and next-guide control from page to page.
Search all guidance
Find a page
63 pages shown
Browse by topic
Subject Areas
Browse by topic if you do not want to follow a route. Choose the topic closest to your question, then open the guide that best matches it.
Subject area
Public Systems and Disruption
Use this topic when a data breach, cyberattack or outage affects a service or organisation. Choose the guide that matches the event and what you need to do.
Data breaches: what they mean and what to do
A breach does not always mean someone has stolen your identity, entered your account or taken money. Base your next steps on the information involved and any signs that it has been misused.
Open the guideT-002Cyberattacks and ransomware: what the public needs to know
An outage does not prove a cyberattack, and a cyberattack does not automatically prove that personal data was stolen. Look for the organisation’s confirmed description of the incident before deciding what it means for you.
Open the guideT-013Digital outages and service disruption
Check the service through a route you already trust and wait for confirmed information about the cause. Treat unexpected workarounds, priority access, refunds and alternative payment instructions as separate claims that require independent confirmation.
Open the guideS-006Has my personal information been exposed?
Check the claim through the affected organisation or service independently and identify the exact information involved. Then match action to the data: secure exposed sign-in details, monitor financial or identity records where relevant and distrust follow-up contact that uses accurate personal details as proof of identity.
Open the guideS-007What should I do after a data breach?
Confirm the breach through the organisation independently and identify the exact data involved. Secure exposed sign-in details and accounts first, then protect payment, identity or sensitive information as relevant. Expect follow-up messages that use real details to appear convincing.
Open the guideS-008Has this service been hacked, or is it simply down?
Treat the service as unavailable until a source you can trust confirms the cause. Check the organisation's known status page, app or official channels directly. Do not use alternative links, support numbers, refunds or payment routes supplied by unsolicited messages during the disruption.
Open the guideSubject area
Technology, Platforms and Channels
Use this topic for suspicious calls, messages, websites, accounts and online services. Start with the type of contact or technology involved.
Accounts, passwords and stolen login details
If you still control the account, secure it from a trusted device: change compromised sign-in details, remove unfamiliar sessions and recovery details, then enable stronger sign-in protection. If you have lost access, use the provider’s official recovery process at once.
Open the guideT-005AI, deepfakes and synthetic impersonation
Do not try to decide authenticity from appearance or sound alone. Break the contact and verify the person, event and requested action through a separate route you already trust.
Open the guideT-006Current scam campaigns and impersonation alerts
Do not decide whether a contact is genuine from the organisation named in it. Check what you are being asked to do, leave the supplied route and verify the situation independently.
Open the guideT-010Social media, online adverts and platform safety
Treat the platform as the place where content was delivered—not as a guarantee that the content, advert, account or opportunity is genuine. Verify important claims and transactions outside the post or message.
Open the guideT-011Scam calls, texts and messaging threats
Do not rely on caller ID, a sender name or an accurate personal detail as proof. Stop the contact, avoid the supplied link or number, and independently reach the organisation or person if the request might be genuine.
Open the guideT-012Malware and infostealers: what they take and what to do
A password change may be necessary, but it is not enough if the device or an active session remains compromised. Contain the suspected device, recover important accounts from a trusted device and confirm whether data or access was taken.
Open the guideP-001Is this a scam?
Pause before you act. Do not judge the contact only by how convincing it looks or sounds. Ask what they want, compare it with what normally happens, and check it using contact details you found yourself.
Open the guideP-002Is this company, person or account genuine?
Do not rely on a name, logo, registration, profile, verified badge or personal detail. Find the organisation or person independently and ask whether they made this exact request through this exact account or channel.
Open the guideP-003Is this text, email or call a scam?
Do not reply, press a key, call the supplied number or use the link while unsure. Open the genuine service yourself or contact the person or organisation through details you already trust.
Open the guideP-004Is this website genuine?
Do not enter details or pay while unsure. Leave the link you were given, find the organisation independently and compare the exact web address and process with its published service.
Open the guideP-005Can a scam message appear in a genuine message thread?
Treat the latest request as a new event. Do not rely on its position in the thread. Leave the message and check the request through the organisation’s official app, website or a contact route you selected independently.
Open the guideP-009Is this family emergency call genuine?
Do not rely on the voice or story alone. End the contact and reach the relative through a number you already know, another family member or a separate trusted route. Do not send money until the emergency is independently confirmed.
Open the guideP-010Is a wrong-number text message a scam?
You do not need to continue the conversation to find out. Do not share information, follow a link or move to another app. If the sender is unknown, end the exchange and use the phone or platform controls to report and block suspicious contact.
Open the guideP-011Is this delivery-fee or unpaid-toll text genuine?
Do not pay through the message link. Check the delivery or journey independently through the official service, using an app, website or reference you found yourself. If you cannot match the claim to a real parcel or journey, do not continue.
Open the guideP-012Why did I receive a verification code I did not request?
Do not share the code or approve the request. Open the relevant account independently, review recent security activity and protect it if the attempt is not yours. A genuine support worker should not need you to read out a code created to authorise your action.
Open the guideP-016Is an unexpected technical-support call genuine?
Do not trust an unexpected support call or pop-up because it names a familiar technology company or shows a warning. End the contact. If you need help, start again through the official support route you locate independently.
Open the guideP-017Should I give a caller remote access to my device?
Do not give remote access to an unsolicited caller. If you genuinely need support, start through the provider’s official route, confirm the technician inside that process and keep the access limited, visible and removable.
Open the guideP-018I installed remote-access software for a caller — what should I do?
Act promptly without trying to diagnose everything at once. End the session, disconnect the device from the internet, contact the bank from another trusted device if financial access was visible, and begin account and device recovery.
Open the guideP-020I replied to a scam message — what happens next?
Stop replying, block and report the sender, and review exactly what you disclosed. If you only replied, the response is usually contact control—not a full account or device recovery. Escalate only if you also clicked, downloaded, shared sensitive information or sent money.
Open the guideP-021I clicked a scam link — what should I do now?
Close the page and do not enter anything else. If you only opened it, report the link and monitor. If you entered a password or bank details, downloaded or installed something, approved a prompt or sent money, protect that account, device or payment route at once.
Open the guideP-029Why do scammers move conversations to WhatsApp or Telegram?
Pause before moving. Keep the original profile, advert and conversation, and verify the person and proposed action independently. If the move is followed by secrecy, urgency, investment instructions, payment outside the platform or requests for codes or access, end contact and report both accounts.
Open the guideS-003What should I do after a suspicious phone call?
End the call and do not call back using a number the caller supplied. Write down what happened, then verify the claim through an official route. If you disclosed access, installed software or paid, protect the affected account, device or money at once before reporting the call.
Open the guideS-005Is this unpaid-bill message genuine?
Do not pay through the message. Open the provider's genuine app or website yourself, check a known account or previous bill, and contact it through a number you already trust. If no matching balance or account exists, report the message and preserve it before deletion.
Open the guideS-012Is this account-security message genuine?
Do not sign in, approve a request or call a number through the message. Open the service independently and check its security activity, sessions and notifications. If the event appears there, follow the provider's own recovery process. If it does not, preserve and report the suspicious contact.
Open the guideS-014Can I trust the number shown on caller ID?
No—not by itself. Do not use the displayed number as identity proof and do not call it back when an important request is involved. End the call, wait if necessary, then reach the person or organisation through a number or account route you selected independently.
Open the guideSubject area
Life Events and High-Stakes Decisions
Use this topic when you need to decide about a job, home, purchase, investment, charity appeal or government payment. Choose the situation closest to yours.
Investment, cryptocurrency and high-risk opportunity scams
Do not send money because a platform displays a profit or a contact creates urgency. Check the firm and its exact permissions independently, understand what protections apply, and test whether the payment destination matches the claimed investment.
Open the guideT-009Online shopping and marketplace scams
Keep the conversation and payment inside the marketplace or retailer’s verified route. Check an unfamiliar seller independently, use a payment method with suitable protection and never treat a screenshot or message as proof that money has arrived.
Open the guideT-018Job-search, recruitment and remote-working scams
Verify the employer, vacancy, recruiter and process independently before sending sensitive documents or money. A job should not require you to receive and forward money, buy cryptocurrency, use your bank account for the employer or pay unexpected recruitment fees.
Open the guideT-019Housing, rental and conveyancing scams
Do not send a deposit or high-value property payment only from an advert, message or changed email instruction. Verify the property, person, firm and bank details independently, using confirmed contact information before money moves.
Open the guideT-020Charity, crisis and public-event scams
Choose the charity or appeal independently, check its identity and registration where applicable, and reach its donation route through an official website or confirmed platform. Do not let urgency force you through a link supplied in an unexpected message.
Open the guideT-021Government payment, benefit, grant and tax scams
Do not use an unexpected message to apply, claim, correct or repay. Find the relevant service independently on GOV.UK or through a contact route you already trust, then check whether the payment or action actually exists for you.
Open the guideP-008Would the police, HMRC or another authority ask for payment this way?
Police, HMRC and other public authorities do not use gift cards, cryptocurrency wallets or privately supplied bank accounts as ordinary routes for urgent penalties or protection payments. Stop and verify through the authority’s official route.
Open the guideP-013Does a genuine recruiter ask for an upfront fee?
Do not pay to secure an unsolicited vacancy or release earnings. Verify the role and recruiter through the employer’s official careers route. Check who receives the payment, what it buys and whether the employer confirms that this is its genuine recruitment process.
Open the guideP-014Is this grant, subsidy or debt-forgiveness offer real?
Do not trust the offer because it uses official-looking branding, knows personal details or says you are pre-approved. Confirm that the scheme exists, that you qualify and that the application route belongs to the issuing authority or creditor before paying or disclosing information.
Open the guideP-015Is this guaranteed cryptocurrency return genuine?
Do not transfer money or cryptocurrency on the strength of a guarantee. Check the firm, product, permissions, payment destination and withdrawal process independently. Stop if the return is described as certain, risk-free or available only if you act at once.
Open the guideS-004Is this tax-refund message genuine?
Do not claim through an unexpected link. Open the official tax account or app yourself, or type the government address into your browser and use the published refund process. A message that asks for personal or financial information in exchange for a refund should be treated as suspicious and reported.
Open the guideS-009Is this remote-working job genuine?
Verify the employer, vacancy and recruiter independently before sending documents, installing software or paying anything. A genuine-looking interview or contract does not make a request for deposits, task funding, cheque forwarding, cryptocurrency or use of your bank account safe.
Open the guideS-010Is this rental or property-payment request genuine?
Do not transfer a deposit, rent, reservation fee or completion money while unsure. Confirm the property and authority to let or sell it, then verify the recipient and bank details through contact information got independently or previously confirmed. Treat changed payment instructions as a new high-risk request.
Open the guideS-011Is this charity appeal genuine?
Pause the appeal and find the charity or organiser independently. Check the relevant charity register, official website, fundraising route and stated use of funds. Donate through a destination you reached yourself rather than an unexpected message, cash request or transfer account.
Open the guideS-013Is this marketplace buyer or seller genuine?
Do not decide from the profile or conversation alone. Check the item, account history, platform messages, actual payment balance and delivery route independently. Do not follow a buyer's payment link, accept a screenshot as proof, send a verification fee or move off-platform merely because the other person says it is necessary.
Open the guideSubject area
Protection, Evidence and Public Rules
Use this topic if money, personal details or account access may be at risk. Find help to save records, report what happened, get money back and know your rights.
Identity theft and misuse: how your information can be used
Knowing that personal information has been exposed is a reason to watch and protect—not proof that identity fraud has occurred. Act quickly when you see an unfamiliar application, account, debt, benefit claim, address change or transaction.
Open the guideT-008Payment fraud and banking protection
Report the payment as soon as possible and describe exactly how it happened. A bank transfer you were tricked into making, an unauthorised card payment and a dispute with a genuine seller are different problems with different protections.
Open the guideT-014Fraud statistics: what the numbers really mean
Read the definition before the headline. Check whether the number describes incidents or people, an estimate or recorded reports, the population and period covered, and whether methods or reporting systems changed.
Open the guideT-015Scam recovery, reimbursement and compensation
Contact the bank or provider at once, secure affected accounts and devices, preserve records and report the incident. Make a clear complaint if the provider rejects or mishandles the claim—and distrust anyone who promises recovery in return for an upfront fee.
Open the guideT-016Online safety law and regulation explained
Treat regulation as an extra layer of protection, not proof that a post, advert, account or search result is genuine. Continue to verify the person, request and route, and report harmful or fraudulent content through the service and the appropriate public route.
Open the guideT-017Viral scam warnings and public alerts
Before sharing a scam warning, find the original source, check its date and scope, and separate confirmed facts from advice or speculation. Report the suspicious item itself rather than circulating an unconfirmed copy.
Open the guideP-006How can I check whether a caller is really from my bank?
End the call. Contact your bank through its official app, the number on the back of your card, a trusted statement or—where your bank supports it—159. Do not call a number supplied by the caller.
Open the guideP-007Would a bank ask me to move money to a safe account?
Treat an unsolicited instruction to move money to a ‘safe account’ as fraudulent. Do not transfer. End the contact and speak to your bank through its official app or a number you selected independently.
Open the guideP-019Does a bank ask for a password or two-factor authentication code?
Do not give a caller your full password, PIN or one-time security code. Do not approve a login or payment you did not start and understand. End the contact and check the claim with the bank through its official app or a trusted number.
Open the guideP-022I shared personal or bank information — what should I do?
Act now based on what you shared. Contact your bank at once if you shared card, banking, security or payment details. Secure exposed accounts through the real app or website. Protect identity documents as advised by the organisation that issued them. Do not wait for money to be taken.
Open the guideP-023How can I reverse a bank transfer sent to a scammer?
Contact the bank or payment provider at once through its official fraud route. Say that you were deceived into making a transfer, identify every payment and ask for urgent stopping, recall, tracing and reimbursement action. Speed matters, but recovery cannot be guaranteed.
Open the guideP-024Do UK bank reimbursement rules apply to me?
They may apply if you are an individual, microenterprise or charity and made a qualifying UK bank transfer on or after 7 October 2024. Report the scam to the payment provider at once and within 13 months. Ask for a formal assessment rather than deciding from a checklist alone.
Open the guideP-025Can chargeback or Section 75 help after a scam?
Contact the card provider promptly and describe exactly what you bought, who you paid, how the payment was made and what went wrong. Ask it to consider chargeback, Section 75 and any other protection that fits. Do not assume that using a card guarantees reimbursement.
Open the guideP-026What if I paid by cryptocurrency, gift card or cash?
Stop further payment, preserve the wallet, card, receipt and conversation details, and contact the organisation that handled the value at once. Ask whether it can freeze, flag or trace the transaction, then report the fraud. Do not pay anyone who promises guaranteed recovery.
Open the guideP-027Can a company or hacker recover my stolen cryptocurrency?
Do not pay an unsolicited recovery company or hacker, and never share a seed phrase, private key or remote access. Contact the exchange or wallet provider involved and report the theft. If you consider professional help, verify the firm independently and reject guarantees or unexplained upfront release fees.
Open the guideP-028Where do I report a scam text, email, advert or website?
If money, account access or personal safety is at risk, contact the bank, service provider or police first. Then use the route that matches the item: suspicious emails to report@phishing.gov.uk, SMS to 7726, suspicious websites to the NCSC, adverts to the platform and ASA, and fraud or cyber crime to Report Fraud or Police Scotland.
Open the guideP-030Why do scammers keep contacting me after I paid?
Stop paying and stop using any route the other party supplied. Contact the bank, card issuer, exchange or other payment provider independently, protect exposed accounts, preserve the complete conversation and report the fraud. Treat any recovery offer as a new, unconfirmed approach.
Open the guide