How to report a scam: a UK & international playbook

Phishing emails

1. Forward the email as an attachment to report@phishing.gov.uk - the NCSC's Suspicious Email Reporting Service (SERS).
2. Report it inside your email client too: Gmail → "Report phishing"; Outlook → "Report message → Phishing". This trains the provider's filters.
3. If the email impersonates a brand (bank, courier, HMRC), forward a copy to that brand's abuse address - most publish one at abuse@brand.com.
4. Run the message through the Verdict Engine if you want a written breakdown of headers, SPF/DKIM, and link risk.

Scam SMS (smishing)

1. Forward the text free of charge to 7726 (spells SPAM). Works on every major UK network - EE, O2, Three, Vodafone, Sky, Tesco.
2. If you tapped a link, change any reused password and run SMS Check on the message to see what you may have exposed.
3. Delete the message. Block the sender. Do not reply, not even "STOP" - it confirms the line is live.

Fraudulent or fake websites

1. Submit the URL to the NCSC: ncsc.gov.uk/report-scam-website.
2. Report to Google Safe Browsing at safebrowsing.google.com - listing there blocks it in Chrome, Firefox and Safari.
3. Look up the domain on ICANN Lookup and email the registrar's abuse contact. Most takedowns happen at the registrar level, not the host.
4. For brand impersonation, file with the brand's security team and reportfraud.ftc.gov if US-facing.
5. Pre-flight the URL through URL Check first so your report includes evidence.

Money lost or attempted fraud

1. Call your bank immediately on the number on the back of your card. UK banks must refund most authorised push-payment fraud under the 2024 PSR reimbursement rules.
2. Report to Action Fraud on 0300 123 2040 or online at actionfraud.police.uk. In Scotland, call 101 instead.
3. Place a CIFAS protective registration if your identity may have been compromised: cifas.org.uk/pr.

International quick reference