How to report a scam text or phishing email in the UK
The UK has two free, official places to send a scam message: texts go to the short number 7726, which reaches your mobile network, and emails go to the National Cyber Security Centre at [email protected]. Reporting takes the message out of circulation for other people, because the network can block the number and the NCSC can get the website behind the link taken down. Steps 1 to 4 cover a text message and steps 5 and 6 cover an email. Follow whichever applies. If you only want to know whether a message is fake, start with how to spot a phishing email.
What you'll need: The scam message itself, still in your Messages app or inbox. A UK mobile number on any UK network, for the text route. Nothing else, and no account to set up.
Open the text and note the number it came from
Open the conversation and look at the top of the screen. The sender shows either as a phone number or as a name such as a courier or bank. Write the number down or remember it, because your network asks for it in step 3.
Forward the text to 7726
On an iPhone, touch and hold the message bubble, tap More, then tap the forward arrow in the bottom-right corner. In the To field, type the number below and tap send.
On an Android phone using Google Messages, touch and hold the message, tap the three dots in the top-right corner, tap Forward, then choose New message and type the number below. Samsung's Messages app has the same Forward option in its long-press menu.
7726Reply with the sender's number when your network asks
Your network sends back an automated text asking for the number the message came from. Reply to that text with the number from step 1, typed exactly as it appeared. If the sender showed as a name rather than a number, reply with the name instead.
That is the report done. Your network uses it to investigate and block the sender, and it won't update you on the outcome.
Report it in the Messages app as well, then delete it
On an iPhone, messages from numbers not in your contacts show a Report Junk link under the message. Tap it, then tap Delete and Report Junk. On Android, touch and hold the conversation in the main list and tap Block, then tick Report spam before confirming.
This sends a copy to Apple or Google rather than to your network, so it is worth doing both. Ofcom's advice is the same.
Forward the email to [email protected]
Open the suspicious email, click or tap Forward, and paste the address below into the To field. You don't need to add any text. Send it, without clicking anything inside the original email first.
This works from any email service or app, including a work address. The NCSC checks the email and any website it links to, and has scam sites removed. It acts on every report but won't tell you what it found.
Report it to your email provider too, then delete it
In Gmail on a computer, open the email, click the three dots at the top right of the message and choose Report phishing. In Outlook on the web, open the email, click Report on the toolbar and choose Report phishing.
This trains your provider's own filters, so the next one from the same sender is more likely to land in Spam. Once reported, delete the email.
Variations
7726 takes calls as well as texts. Open your phone's recent calls list, copy the number that called you, and send it in a new text message to 7726. Don't call the number back, especially if it starts with 070, 076, 084, 087, 090, 091 or 118, as those can cost a lot per minute.
If the scam reached you some other way, or you want to report the website on its own, use the NCSC's form at ncsc.gov.uk/report-scam-website. Paste the web address into the form rather than visiting the site again. If the link arrived in an email, forwarding the email as in step 5 covers the website too.
7726 only works for ordinary text messages. For WhatsApp, open the chat, tap the sender's name at the top, scroll to the bottom and tap Report, or Block and tick Report contact. WhatsApp receives the last few messages from that chat.
Troubleshooting
Check how you addressed it. If 7726 is saved as a contact, some phones send to +447726 instead, which goes nowhere. Delete the contact and type 7726 by hand. A message containing a long link can also be split in two by the phone, which confuses the service. If a second try gets no reply, use Report Junk or Report spam as in step 4 instead, which still gets the message reported.
Forwarding from the Spam or Junk folder works in Gmail and Outlook. If your app refuses because the message is flagged as dangerous, move it to the inbox, forward it, then delete it. Don't open any attachment while doing so. If the email is one your provider has already caught and labelled, the NCSC will often have it already, so losing this one report is no great loss.
Reporting the message is still worth doing, but it isn't the urgent part. If you entered a password, change it now on the real website, and on any other account where you used the same one. If you gave card or bank details, phone your bank on the number printed on the card. Then report the crime to Report Fraud, which replaced Action Fraud in January 2026, at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101 instead.
Need a calculator rather than a guide? Try Simplicalcs →