Reporting a scam in the UK means talking to three different organisations, and none of them does all of it. One is about your money, one is about the crime, and one is about the message or the website. Doing all three takes about fifteen minutes.
Your bank comes first
If money has left your account, call your bank before you report anything to anybody else. Use the number on your card or in the banking app, not one from the message that caught you out. Ask them to stop or recall the payment and to freeze the card or account if the details are compromised.
Since 7 October 2024, banks have had to reimburse most people who were tricked into sending a payment to a fraudster, and the rules say within five business days of the claim — though a firm can stop that clock while it gathers information, there is a cap of £85,000, and some banks apply an excess. Reporting quickly, and being straight about what happened, is what makes that process run rather than stall.
The crime: reportfraud.police.uk
Fraud in England, Wales and Northern Ireland is reported at reportfraud.police.uk, or on 0300 123 2040 if you would rather talk to someone. The report goes into the national fraud database, where it is matched against other reports; a single report rarely produces an investigation, and a hundred matching ones often do.
In Scotland it is different: contact Police Scotland on 101, or through the contact form on their website. If a crime is happening right now or someone is in danger, that is 999 wherever you are.
You will be given a reference number. Keep it. Your bank, your insurer and your employer may all ask for it, and it is the only thing that proves the report exists.
The message: 7726 and [email protected]
Forward a scam text to 7726 — it spells SPAM on a keypad, it is free, and every mobile network in the UK accepts it. You will get an automatic reply asking for the sender’s number; sending it back is part of the process and is safe to do.
For a scam call, text the word Call followed by the caller’s number to 7726 instead.
Suspicious emails go to [email protected], run by the National Cyber Security Centre. Forward it even if you are not sure — you are not wasting anybody’s time, and the service is automated on the way in. Scam websites have their own reporting form on the NCSC site. Millions of reports have gone in this way and tens of thousands of scam sites have been removed as a result, but you will never hear the outcome of your own, which is the trade-off for a service that can run at that scale.
What each one can and cannot do
Your bank can move money and block cards. The police can investigate a pattern. The NCSC can get a site taken down and the message blocked. None of them can do the other two jobs, which is why “I reported it” so often ends in “and nothing happened” — the report went to the party without the power to act on that part of it.
There is a fourth party nobody mentions: the company hosting the page, and the registrar that sold its domain name. A clear abuse report to the host — the exact address, one sentence on what the page does, a screenshot — is frequently the fastest way a scam page comes down, faster than any official route.
If you clicked, or entered something
Change that password on the real site now, and anywhere you reused it, then turn on two-step verification. If you gave card details, call your bank. If you read out a one-time code to someone on the phone, assume they are inside the account already and use the provider’s account-recovery process rather than a password change.
If you installed anything they asked you to install, particularly remote-access software during a “bank security” or “tech support” call, treat the device as no longer yours. Remove the software, change your banking credentials from a different device, and tell the bank exactly which program it was.
Afterwards
Check your credit file for accounts you did not open. If your details are circulating, Cifas offers a protective registration that makes lenders take extra steps before granting credit in your name. And expect a follow-up attempt: people who have lost money once get contacted again by someone offering to recover it for a fee. That is the same fraud with a different script.