Phishing is one of the most common and deceptive scams in the UK today. It involves emails, texts, QR codes—even phone calls or deepfake voices—that trick people into giving away sensitive info or money. Scammers mimic trusted brands like banks, HMRC, the DVLA, and more to make their lies seem real.
Why Should You Care?
- Since launching in April 2020, the Suspicious Email Reporting Service (SERS) has received over 41 million reports, leading to removal of 217,000 scam sites and pages (Action Fraud).
- Around 85% of UK businesses faced phishing attacks over the past year, and 2024–25 saw a 2% rise. The average cost for business recovery has also jumped by over 30% (dojo.tech).
Common UK Scams to Recognise
👤 DVLA Impersonation
Scammers send texts, emails or calls pretending to be the DVLA—claiming your vehicle tax is unpaid or promising licence point points removal. They often link to fake websites mimicking gov.uk. Note: DVLA never asks for your bank or credit card details via email or text (The Sun).
💼 HMRC Tax Refund Scams
Messages claim you’re due a tax refund. With official logos and believable language, they link to fake HMRC sites asking for NI numbers and bank info. In one operation, fraudsters targeted 100,000 accounts and stole ~£47 million (IT Pro).
📦 Fake Offers – “Free Hampers”
Scammers promise free goods from big brands (M&S, Amazon, Screwfix) if you just pay P&P. Once you share card details, they set up recurring charges from dubious merchants. Lloyds has refunded £55,000 so far, but total losses may be up to £220,000 (The Guardian).
📱 Royal Mail Redelivery Texts
You receive a message saying a parcel failed delivery—follow the link and enter your payment details. But the website is fake, and your financial info is stolen (galaxyit.co.uk).
📧 AI‑Powered Spear Phishing & Vishing
In 2025, scammers are using AI to write ultra-convincing messages and clone voices, even impersonating bosses or family members via phone calls or messages. These tricks bypass usual red flags and trick both businesses and individuals (Which?).
📲 Quishing (QR‑Code Phishing)
Known as “quishing,” scammers send malicious QR codes in letters or ads that lead you to fake sites requesting your data. It’s a growing concern in the UK (Wikipedia).
🚩 Guessing the Red Flags
- Generic greetings like “Dear Customer” instead of using your name.
- Misspelled or spoofed email addresses that look similar but aren’t official domains.
- Urgent or threatening language, pressuring you to act fast or face consequences.
- Suspicious links or attachments—hover to check the real URL. Don’t click unknown files.
- Requests for personal or financial info via email, text, phone or QR scan (itdepartment-uk.com).
What to Do If You Spot a Phish
- Don’t click, reply, or download attachments.
- Go directly to official sites, don’t follow links in suspect messages.
- Forward phishing emails to report@phishing.gov.uk; texts to 7726… it’s free (GOV.UK).
- If you lost money or suspect fraud: Report to Action Fraud (England & Wales) or Police Scotland (if in Scotland) (GOV.UK).
- If banking info was shared: call your bank ASAP and review your statements for any unauthorized charges.
- Reset your passwords and run antivirus scans on your devices.
- Enable Multi‑Factor Authentication (MFA) wherever possible for an extra layer of defence (The Guardian).
Prevention Tips at a Glimpse
- Watch for unexpected messages, especially those claiming there’s a problem or a benefit.
- Keep personal information off public profiles—scammers may use it for tailoring spoof messages ☠️ (Which?).
- Train others—especially older or less tech-savvy folks—to recognise phishing attempts.
- Use trusted cyber hygiene measures: up-to-date antivirus, secure apps, and privacy settings.
- Businesses should: deliver regular awareness training, deploy email filters, and encourage reporting culture (dojo.tech).
Summary
Phishing is ever-evolving—and increasingly clever in the UK. From fake freebies and QR codes to voice-cloned phone calls, the threat is real. But by staying alert, verifying messages, reporting suspicious attempts, and using security best practices, you can protect yourself. Forward any dodgy email or text, report fraud, and stay one step ahead.