Is This Text a Scam? How to Spot Fake Texts in the UK

Your phone buzzes. It says a parcel could not be delivered, or your bank has spotted something odd, or you owe the DVLA a few quid. There is a link, and a reason to hurry. Your thumb is already hovering over it. Before you tap, stop. Most texts like this are scams, and a few seconds of checking is all it takes to know for sure.

I run Kells Security Solutions to explain scams in plain English, and "is this text a scam?" is the question I get asked more than any other. This page gives you a quick test you can use on any message, then the most common fake texts in the UK, and what to do if you have already clicked.

The 30-Second Test for Any Suspicious Text

Ask yourself four questions. If any answer worries you, treat the message as fake.

First, were you expecting it? A "missed delivery" when you have ordered nothing, or a refund from a company you have never dealt with, is a red flag straight away. Second, does it rush you? Scammers always add a deadline, such as "within 24 hours" or "your account will be closed", because panic stops you thinking. Third, does it ask you to tap a link or ring a number you have not heard of? Fourth, does it ask for money, a card number, a password or a code, however small the amount?

A real company can prove who it is without hurrying you. If you are not sure, do not use anything in the message. Open the official app yourself, type the website address in by hand, or ring the number on the back of your bank card.

The Fake Texts I See Most Often in the UK

Parcel delivery texts are the big one. They claim to be from Royal Mail, Evri, DPD or DHL and say a package is waiting, with a small fee to pay for redelivery. The fee is tiny on purpose, because the real aim is your card details. If you are expecting a parcel, go to the courier's own website or app and use your tracking number there.

Bank texts come next. They say there has been a suspicious payment or your account is locked, and give you a link to "verify" yourself. Your bank will not ask you to confirm your PIN, full password or a one-time code by text link. Some scammers even send these into the same message thread as genuine texts from your bank, so a familiar-looking thread is no proof.

Then there are the government ones. A text from the DVLA about vehicle tax, a tax refund from HMRC, or a council tax rebate all follow the same pattern: a payment owed or due to you, and a link that leads to a copycat website. Genuine refunds do not arrive by tapping a link in a text.

The "Hi Mum" or "Hi Dad" text deserves a mention too. A message from an unknown number says your son or daughter has lost their phone and needs money sent urgently. Ring the real number you already have before you do anything. I cover the phone version of the same trick in how to protect your family from AI voice clone scams, including the family safe word that beats both.

Finally, watch for texts offering prizes, energy bill rebates, or a job you did not apply for. If it sounds too good, it is.

How to Spot a Fake Link

Scammers copy the look of real websites, but the address gives them away. Be wary of web addresses full of random letters, extra words such as "secure" or "refund" stuck to a real brand name, or strange endings. Shortened links hide where they lead, so never trust one in an unexpected text. On a phone, you can press and hold a link to preview the address without opening it. If the address does not clearly belong to the company, do not tap.

Do not rely on a message looking professional either. Logos and wording are easy to copy, and criminals can even make a text appear in the same conversation as a real one by faking the sender name. The only safe habit is to go to the company yourself through a route you trust.

What To Do With a Scam Text

If you have not clicked, do not reply, not even to say "stop". A reply tells them your number is live. Instead, forward the text to 7726, the free spam reporting service run by the mobile networks. It spells SPAM on the keypad, and the networks use reports to block the sender. Then delete the message and block the number.

You can also report fraud and scams to Report Fraud, the service that replaced Action Fraud, or ring Police Scotland on 101 if you are in Scotland. The National Cyber Security Centre has further advice on spotting and reporting phishing. I have laid out the other options in where I actually report a scam, and my Safety Toolkit keeps the main links in one place.

If You Have Already Clicked or Paid

Do not panic, and do not feel daft. These messages are built by professionals. What matters now is speed.

If you entered card or bank details, ring your bank straight away on 159, the number the banking industry set up for exactly this, or use the number on the back of your card. Tell them what happened and ask them to stop or block any payments. If you typed in a password, change it on the real website straight away, and anywhere else you use the same one. Turn on two-step verification where you can. If you gave away a one-time code, treat that account as compromised and tell the provider.

Keep a screenshot of the text, then report it as above. If you are worried about an older relative who might tap without thinking, my guide to helping an older parent stay safe online shows how to bring it up kindly.

Make a Habit of Pausing

You do not need to be a tech expert to beat scam texts. You need one habit: pause, then check through a route you trust. Scammers make their money from the half-second when you act before you think, and a pause takes that away. Scammers also pick up details from what people post, so it helps to read the social media habits that quietly put people at risk.

If you would like the checks on one page for the fridge door, sign up for my free online safety checklist. My book Spot the Scam explains the ten cons most likely to catch people out, in plain English. You can read about me and why I do this, and if you have a text you are not sure about, get in touch and I will take a look.