QR phishing6 minute read
Links and account access
QR code phishing and fake login pages
Unexpected QR codes can open copied login or payment pages before you have a useful chance to inspect the real address.
Scams by type
Email scams: the sender name is a costume.
A display name, a logo and a signature cost nothing to copy, which is why email remains one of the most common routes for scams. A phishing email wants you to sign in on a fake page, open an attachment, call a fake support number, pay a changed invoice or panic about a threat.
Look past what the email shows to what it asks. If it wants a login, a payment, a phone call or a download, go to the service yourself instead of through the email. The guides below cover the patterns we see most.
11 guides · Updated 13 October 2026
The guides
Choose the one that matches.
Each guide shows a realistic example with the warning signs marked, how to verify the contact without using its details, and what to do if you already acted.
Tech support scams6 minute read
Devices and account access
Tech-support and remote-access scams
Fake security alerts and refund calls create a computer problem, then ask for remote control, banking access or a difficult-to-reverse payment.
Marketplace scams6 minute read
Shopping and services
Online marketplace buyer and seller scams
Fake buyers and sellers move conversations off-platform, imitate payment notices and remove the protections that make a marketplace useful.
Business payment fraud6 minute read
Work and employment
Business email compromise and invoice fraud
Compromised or imitated business accounts redirect real payments by changing bank details, creating executive urgency or taking over an existing email thread.
Rental scams6 minute read
Shopping and services
Rental-listing and deposit scams
Copied photos, below-market prices and remote-landlord stories create pressure to pay or share identity documents before a property is genuinely available.
Recovery scams6 minute read
Money and impersonation
Refund and scam-recovery fraud
People who have already lost money are targeted again by fake investigators, recovery agents and officials who promise guaranteed results for a fee.
Gift card payments9 minute read
Money and impersonation
Gift card payment demands
Fake officials, support staff, bosses, prize organisers and online partners tell different stories but ask for the same thing: the numbers and PINs from gift cards, which can be spent without the card and are hard to recover.
Fake invoices10 minute read
Shopping and services
Fake invoices and subscription-renewal emails
A fake invoice, order confirmation or auto-renewal notice invents an alarming charge, then steers you to a phone call where scammers ask for remote access, card details or a ‘refund’ payment.
Tickets and travel9 minute read
Shopping and services
Ticket, holiday and booking scams
Sold-out events, holiday deals and travel disruption give scammers a reason to rush you — through resale posts, copycat sites, fake helplines and booking messages that ask you to pay or ‘re-verify’ a card.
Prize and lottery scams9 minute read
Money and impersonation
Prize, lottery and giveaway scams
A message says you have won a lottery, prize draw or giveaway, then asks for a fee, ‘tax’ or your bank details before anything can be released.
Sextortion10 minute read
Relationships and trust
Sextortion emails and image-based threats
Sextortion uses shame and a deadline to demand money, whether it arrives as a mass email bluffing about webcam footage or from a fake online contact threatening to share an intimate image.
What they have in common
Signs that come up again and again.
- A display name that says one organisation while the address or link points somewhere else
- An urgent problem with an account, a payment, a delivery or a subscription
- An invoice or renewal you don’t recognise, with a phone number to ‘cancel’
- A request to change bank details or to make an unusual or confidential payment
- An attachment or sign-in link you were not expecting
- A claim that you have been hacked or recorded, with a demand for payment
What to do
Three moves that work every time.
Don’t use its links, numbers or attachments
Everything inside the email is supplied by the sender. Treat links, phone numbers and attachments as unverified.
Go to the account yourself
Sign in through the official app or an address you type, or check your bank statement. If a supplier changed bank details, confirm by phone on a number you already hold.
Report it, then delete it
Use your email provider’s report-phishing option, and your national reporting address where there is one.
Practise the pause
What would you do?
Try a realistic scenario before it happens for real. Choose a response and see why it helps or hurts.
Common questions
Short answers.
Is it dangerous just to open a scam email?
Opening and reading an email is not usually the problem. The risk comes from clicking links, opening attachments, replying or calling a number in it. Keep your device and email app updated, report the message and delete it.
How can I check where a link really goes?
On a computer, hovering over a link shows its real address; on a phone, a long press usually does. Then read the part of the address that decides who controls the site — our exercise shows you how.
Practise reading web addressesThe email came from a real address I know. Can it still be a scam?
Yes. Accounts can be taken over, and criminals sometimes reply inside a genuine email thread. If the request involves money or bank details, confirm it by phone on a number you already have.
Business email compromiseSources
Official guidance used on this page.
U.S. Federal Trade CommissionHow To Recognize and Avoid Phishing ScamsSeptember 2022 · Opens official source ↗UK National Cyber Security CentrePhishing scams: how to spot and report themReviewed 5 September 2022 · Opens official source ↗UK National Cyber Security CentreReport a scam emailReviewed 5 September 2022 · Opens official source ↗