Phishing is the most common scam on the internet and the entry point for nearly every other kind. A convincing text or email points you to a fake login page, and your credentials are instantly sold or used to empty accounts.
Every case follows roughly the same playbook. Recognize the pattern, stop it early.
A text, email, or call claiming to be your bank, the post office, a tax authority, or a subscription service.
'Your account will be closed', 'package held at customs', 'unauthorized charge'. You have hours, not days.
A link to a page that looks identical to the real site but lives on a lookalike domain (amazn.com, paypaI.com, etc.).
You log in. They capture everything — including your 2FA code in real time.
Within minutes, funds are moved, accounts locked, or personal data sold on.
If you're seeing two or more of these, assume it's a scam until proven otherwise.
Real institutions give you days, not hours.
amazn.com, paypa1.com, usps-delivery.shop — always read the URL carefully.
'Dear Customer' instead of your actual name.
Real companies never do this.
The visible text says paypal.com but the actual link goes somewhere else.
All anonymized. Submitted through our report form.
A text from 'Royal Mail' said there was £2.99 to pay on a package. I was expecting one so I tapped the link and entered my card. Twenty minutes later they called pretending to be my bank's fraud team, walked me through 'moving my money to a safe account,' and took £4,200.
Hover over links before clicking. On mobile, long-press to reveal the actual URL.
Never enter credentials from a link you didn't expect.
Go direct — open the company's app or type the URL yourself instead of tapping links from texts or emails.
Never move money to a 'safe account' on instruction from a phone caller — real banks never ask this.
Your story could stop the next person from losing their savings. Submit anonymously in about two minutes.