Online scams have become more convincing over the years, but the tactics behind them haven’t changed much. Once you know what to look for, you’ll spot them before any harm is done. Here’s what you need to know.

What is phishing?

Phishing is when someone pretends to be a trusted organisation, your bank, Royal Mail, HMRC, Amazon, or even a friend, to trick you into handing over personal details or clicking a dangerous link.

It usually arrives as an email or text message. Common examples:

“Your parcel couldn’t be delivered, pay £1.99 to rebook” (Royal Mail impersonation)
“Your account has been suspended, click here to verify your details” (bank impersonation)
“You have a tax refund waiting, submit your bank details” (HMRC impersonation)
“Your Netflix payment failed, update your card now” (streaming service impersonation)

These messages are designed to feel urgent, so you act before you think.

How to spot a scam message

Check who actually sent it. In email, tap or hover over the sender’s name to see the real address. A genuine email from your bank won’t come from service@natwest-alerts.info or a string of random letters. Look for misspellings, extra words, or odd domains.

Look at the link before you click it. On a phone, press and hold a link to see the actual web address before opening it. If it doesn’t match the organisation’s real website, don’t click.

Notice the urgency. Phrases like “act immediately”, “your account will be closed”, or “you have 24 hours” are pressure tactics. Scammers want you to panic and skip the checks. Real organisations rarely threaten immediate consequences like this.

Poor spelling and grammar. Many scam messages contain subtle errors, not always obvious typos, but oddly phrased sentences that feel slightly off.

They’re asking for something unusual. Your bank will never ask for your full PIN, password, or one-time code over email or text. HMRC will never ask for immediate payment by gift card or bank transfer.

What to do if you’re not sure

If a message claims to be from your bank or a company you use, don’t click any links in the message. Instead:

Close the message
Open your browser and go directly to the organisation’s official website (type the address yourself, or search for it)
Log in as normal and check if there’s actually a problem with your account

If the message was genuine, you’ll see the issue there. If there’s nothing wrong, it was a scam.

For unexpected parcel notifications: if you weren’t expecting a delivery, it’s almost certainly fake.

Suspicious links, the golden rule

If you didn’t expect it, don’t click it.

Even links that look legitimate can be deceptive. Scammers use web addresses like amazon-support-account.com that look real at first glance but aren’t.

If someone sends you a link, even someone you know, and it seems out of character or unexpected, message them separately to check they actually sent it. Accounts get hacked, and messages can be forwarded without the sender’s knowledge.

What if you’ve already clicked something?

Don’t panic, clicking a link alone usually isn’t enough to cause harm. What matters is what happened next.

If you entered any personal details (name, address, date of birth, bank details, password):

Change any passwords that might be affected, starting with your email and bank
Call your bank directly if you gave any financial information (use the number on the back of your card, not from the email)
Report it to Action Fraud (the UK’s national fraud reporting centre): actionfraud.police.uk or 0300 123 2040

If you didn’t enter anything, you’re almost certainly fine. Close the tab and move on.

If you installed something, this is more serious. Contact a trusted person for help, or take the device to a local repair shop or library IT desk.

Staying safer day to day

A few habits that make a big difference:

Use different passwords for different accounts, especially your email and bank. A password manager (like the one built into your iPhone) makes this easy.
Turn on two-step verification for your email and banking apps. Even if someone gets your password, they can’t get in without your phone.
Keep your phone and apps updated, updates often include security fixes.
Be sceptical by default. It’s okay to ignore, delete, or not respond to a message while you think about it. Nothing genuine will fall apart in 10 minutes.

Not sure if a message is genuine, or had a worrying experience online? Get in touch with Hebden Tech Tutors, we’re happy to help you work through it.