A familiar provider name is easy to copy
Branding, sender names, bill layouts and account language can be reproduced without access to the real account.
Technology, platforms and channels
Is this unpaid-bill message genuine?
An unpaid bill, invoice or account warning can be real. But an unexpected message does not confirm that the debt exists or that the supplied payment route belongs to the genuine provider.
Page S-005Guidance pageReviewed 29 August 2026
Key Guidance
Do not pay through the message. Open the provider's genuine app or website yourself, check a known account or previous bill, and contact it through a number you already trust. If no matching balance or account exists, report the message and preserve it before deletion.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
The safest check separates three questions: is the account yours, is money actually due and is this the provider's genuine payment route?
Urgency makes verification feel risky
Threats of closure, penalties, court action or lost service encourage payment before the debt is checked.
A link can change the destination
The visible wording may resemble a provider while the page collects card details, sign-in details or payment for a false balance.
A real bill can still contain altered details
A compromised email account or intercepted invoice can preserve genuine context while replacing the payment destination.
Consequences and movement
What may happen next
Check the account and payment destination independently. Do not ask the sender to prove the bill using more documents it controls.
A matching balance appears
Pay only through the provider's normal app, portal, bill instructions or independently verified account details.
The account exists but details differ
Contact the provider before paying. Treat changed bank details, a new payee or a different reference as unconfirmed.
No account or balance appears
Do not pay. Report the message through the claimed provider and the relevant phishing or telecoms route.
You already paid or signed in
Contact the bank or provider at once, protect exposed sign-in details and preserve the message, page address and transaction details.
Practical response
What you should do
Move the check away from the message. A genuine balance will remain visible or confirmable through an official route.
- Pause the paymentDo not use the link, QR code, phone number, reply address or bank details supplied in the unexpected message.
- Find the account independentlyOpen a saved genuine app, type the provider's address yourself or use contact details from a previous verified bill.
- Match the bill factsCheck the customer name, account, billing period, amount, service, previous payments and whether the claimed debt appears in the account.
- Verify changed payment detailsConfirm any new bank account, payee or payment reference through a trusted contact route before sending money.
- Report suspicious contactForward suspicious emails to the national phishing service and texts to 7726 where applicable. Also notify the impersonated provider.
- Act after payment or disclosureTell the bank or account provider at once, change exposed passwords and report actual fraud through the route for your location.
Look more closely
A claimed debt should be checked inside the real account
Loss of service, penalties and deadlines can make immediate payment feel necessary. Open the provider’s genuine app or website independently and confirm both the balance and payment details there.
A bill or overdue warning arrives unexpectedly.
Service loss, penalties or legal effects create pressure.
A known provider, supplier or authority is copied.
A link, QR code or new bank account controls payment.
The real account confirms whether anything is due.
Selected history
Historical cases and lasting lessons
Phishing through payment demands
National cyber guidance describes scam messages that direct people to malicious sites designed to steal sign-in details, bank details or money.
Lasting lesson: The requested payment and the supplied destination must be verified separately.
Altered invoice and business-payment fraud
Official guidance warns that criminals may impersonate a regular contact or send an invoice with a different payment account.
Lasting lesson: Familiar context does not make changed bank details safe.
Transferable understanding
Patterns over time
Consequences arrive before evidence
The message describes closure, enforcement or fees without giving you time to confirm the underlying account.
Small amounts reduce checking
A modest overdue balance can feel cheaper to pay than investigate, especially when a deadline is near.
The sender may know a real relationship
A genuine provider, supplier or invoice can be learned from exposed email, public information or earlier contact.
Payment changes deserve fresh verification
A new account number or payee is a new route even when the invoice itself is genuine.
Plain-language answers
Common questions
Does a correct account number prove the message is genuine?
No. It may be copied from another source. Check the balance and message through the provider's official account or contact route.
What if the service really is about to be closed?
Use the provider's genuine route at once. A real deadline does not require you to trust an unsolicited link.
Can I reply and ask for proof?
Do not rely on evidence supplied by the same sender. It can be fabricated. Contact the provider independently.
What if I paid a genuine bill to the wrong account?
Contact your bank and the genuine provider at once. Preserve the invoice and every message showing how the payment details changed.
Verify the debt and the destination separately
Check a genuine account first, then use the provider's normal payment route. Report the message if the balance, account or destination cannot be confirmed.
Scamology Insights
A bill is a claim; the payment route is a separate decision
These learning resources can help you spot how urgency and a familiar identity may direct you to pay before checking whether the debt is real. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency