I clicked a link in a scam text: what to do now (UK)

Start here: what did you do after you tapped?

You only opened the page and closed it

The NCSC says the purpose of a scam text is often to get you to tap a link, and that the website behind it is used to download viruses or to steal passwords and other personal information. On phones, its missed-parcel guidance describes the download as an "app" the page asks you to install.

If you typed nothing and installed nothing, neither of those things happened. Report the text and the site (see below), and make sure your phone is up to date: the NCSC advises installing the latest software and patches.

You typed a password or a code

Change that password now. The NCSC says to change the password on any of your accounts that use the same one, and Stop! Think Fraud explains why: criminals try a stolen password on other accounts. Then log out of the account on all your apps and devices, so anyone else using it has to enter the new password, and turn on 2-step verification.

If what you typed was a one-time code, see verification code texts you didn't ask for. If it was your Apple Account password, see Apple and iCloud scam texts.

You gave card or bank details

Call your bank now. The NCSC's advice when you have given out banking details is to contact your bank and let them know. Use 159 or the number on the back of your card: Stop Scams UK says 159 puts you through to your own bank and cannot be faked. For texts that pretend to be your bank, see how to check a bank text.

You installed an app

The NCSC has guidance for exactly this case. It says the "app" in these texts is malware that can steal your banking details, passwords and other sensitive information, and that it also tries to send scam texts to your contacts.

You lost money

Tell your bank first, then report it as a crime: the NCSC names Report Fraud for England, Wales and Northern Ireland (reportfraud.police.uk or 0300 123 2040) and Police Scotland, on 101, for Scotland. Report Fraud replaced Action Fraud in December 2025, so ignore older pages that still send you to Action Fraud.

Report the text and the website

• Forward the text to 7726, free on most networks, then delete it. The NCSC says reporting helps cut the scam texts you get and protects other people.
• Report the website to the NCSC.
• Can't forward it? The NCSC also takes a screenshot or screen recording of the text at report@phishing.gov.uk.

What to watch for in the next few weeks

The NCSC's advice for people whose details have been exposed applies here too: stay alert to suspicious messages, which can arrive some time later, and to remember that your bank, or any other official organisation, will never ask you to supply personal information.

Stop! Think Fraud lists the signs that an account has been taken over: you can't log in, your security settings have changed, messages you don't recognise were sent from your account, someone tried to log in from an unusual place, or there are payments you didn't make. If a caller says they are from your bank and asks you to act, hang up and call 159.

Got another text you are unsure about? Paste it into the scam text checker. More on texts pretending to be your bank and parcel delivery scam texts.

Sources

• NCSC, if you've shared sensitive information: NCSC, 'Phishing scams: If you've shared sensitive information' (published 26 November 2021, reviewed 5 September 2022): "You’ve provided your banking details: Contact your bank and let them know. ... You've given out your password: You should change the passwords on any of your accounts which use the same password. ... You've lost money: Tell your bank and report it as a crime to Report Fraud (for England, Wales and Northern Ireland) or Police Scotland (for Scotland)." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/what-to-do, read on 2026-10-02
• NCSC, missed parcel texts and malware: NCSC, 'Scam 'missed parcel' SMS messages: advice on avoiding malware' (published 23 April 2021, reviewed 15 December 2023): "The scam SMS messages contain links to what appear to be ‘official’ delivery/parcel-tracking apps, which you’re encouraged to install. But the ‘app’ is in fact a type of malware. If installed, this malware can steal your banking details, passwords, and other sensitive information. ... if you think you may have been tricked into installing malware from a scam message, then it’s important that you don’t log into any accounts, as the malware may steal these details. Instead, as soon as you can, you should perform a factory reset on your device. Note: It’s important that you don’t back up your data before you perform a factory reset, as the backup will also contain the malware. For the same reason, when you’re given the option to restore backups, you should only do so if you’re confident that the backup was created before you installed the malware. If you can’t be sure, you should perform a factory reset and not restore any backups. ... If you have logged into any accounts or apps since installing the malware, you must change the password for that account ... set up two-step verification (2SV) on accounts, where possible. ... a safer way of tracking its status is to use the official website of the delivery companies. ... Ensure your device is kept up to date by installing the latest software and patches." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/guidance/scam-missed-parcel-sms-messages, read on 2026-10-02
• NCSC, report a scam text: NCSC, 'Report a scam text' (published 26 November 2021, reviewed 5 September 2022): "By reporting, you can: reduce the amount of scam texts you receive; make yourself a harder target for scammers; protect others from cyber crime online. 40.9K scams removed across 93.3k URLs as of July 2026 as part of the 7726 service. ... You can also take a screenshot or screen recording of the text message and send it to us at report@phishing.gov.uk ... If 7726 doesn't work, you can find out how to report a text message by contacting your phone provider. ... The purpose of a scam text message is often to get you to click a link. This will take you to a website which criminals use to download viruses to your computer, or steal passwords or other personal information." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-10-02
• NCSC, how to spot a scam: NCSC, 'How to spot a scam email, text message or call' (published 26 November 2021, reviewed 5 September 2022): "Urgency Are you told you have a limited time to respond (such as 'within 24 hours' or 'immediately')? Criminals often threaten you with fines or other negative consequences. ... If you have any doubts about a message, contact the organisation directly. Don’t use the numbers or address in the message – use the details from their official website." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams, read on 2026-10-02
• NCSC, after your details are exposed: NCSC, 'Data breaches: guidance for individuals and families' (published 28 January 2021): "Be alert to suspicious messages (we've published guidance that can help you with this), which may be sent some time after the breach is made public. Remember, your bank (or any other official organisation) will never ask you to supply personal information." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/guidance/data-breaches, read on 2026-10-02
• Stop! Think Fraud, if you've been hacked: Stop! Think Fraud (UK Government campaign), 'What to do if you've been hacked': "There are a number of signs that your email account, social media account or bank account might have been hacked. They include being unable to log into your accounts, changes to your security settings, messages sent from your account that you don’t recognise, attempted log-ins from unusual locations, and unauthorised payments from your online accounts. ... If you use the same password for any other accounts or sites, you will need to change all of them, as cyber criminals will try the same ‘hacked’ password across multiple accounts. ... Once you’ve changed your passwords, you need to make sure you log out of your accounts on all your apps and devices. ... 2SV (also known as two-factor authentication or 2FA) usually works by sending you a PIN or code, which you’ll then have to enter to prove that it’s really you." Contains public sector information licensed under the Open Government Licence v3.0. — https://stopthinkfraud.campaign.gov.uk/recovery-from-fraud/recovering-losses/what-to-do-if-youve-been-hacked/, read on 2026-10-02
• Stop Scams UK, 159: Stop Scams UK, '159 Phone number', summarised in our own words: the short number 159 puts you through to your own bank (it covers more than 99% of UK retail bank current accounts), and its caller ID cannot be faked. — https://stopscamsuk.org.uk/our-programmes/159-phone-number/, read on 2026-10-02
• NCSC, forwarding to 7726: NCSC, Report a scam text: "Most phone providers are part of a scheme that allows customers to report suspicious text messages for free by forwarding it to 7726. If you forward a text to 7726, your provider can investigate the origin of the text and arrange to block or ban the sender, if it's found to be malicious." — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-09-29
• Report Fraud: Action Fraud / City of London Police press release, 4 Dec 2025, summarised in our own words: from 4 December 2025 fraud and cyber crime in England, Wales and Northern Ireland are reported to the new Report Fraud service, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040; people in Scotland keep calling Police Scotland on 101. — https://www.wired-gov.net/wg/news.nsf/articles/Report+Fraud+service+goes+live+04122025143000; https://www.reportfraud.police.uk/, read on 2026-09-29

Quotes from GOV.UK, legislation.gov.uk, mygov.scot, the NCSC, the ICO and NHS England are used under the Open Government Licence v3.0; material from Ofcom is Ofcom copyright. Other pages are summarised in our own words or quoted briefly, with a link. How we check.