Does that company actually text you?
Impersonation is the world's most-reported scam — a text or email wearing a trusted name. The fastest way to break it is to know how that company really reaches you. Search a bank, government agency, courier, payment app, tech company or public figure below and see its own published position: how it contacts you, what it will never do, and how to check.
Check the provider's actual message policy, then verify independently. Genuine Interac notices without Autodeposit can include deposit links, and some couriers document payment notices. A link, logo or expected message cannot establish who sent it. Open the genuine app or website yourself, or use a known number. Never move money because a caller says it needs protecting or give that caller a sign-in code.
Correction · 9 October 2026: The Interac entry and page summary wrongly extended Autodeposit's no-security-question process to all genuine deposits. Manual-transfer notices can include deposit links. We also removed the generic bank rule forbidding every texted verification link. These live corrections do not amend the archived dataset. See the correction record.
Don’t see a company? The rule is the same for all of them: a real organisation never needs you to act through a link in an unexpected text or email. Go to the official app or type the address yourself. Not sure about a message? Ask us free.
Impersonation is one scam wearing a thousand logos
Imposter scams are the most-reported fraud category year after year, and they all run the same play: borrow a name you trust — your bank, the tax office, a courier, Amazon, Apple — and use the trust that name carries to make you act before you think. The logo, the formatting, even the sender ID can all be faked. What can't be faked is the company's actual behaviour, and that's the one thing most people never check.
Organisations publish different rules for different messages. A link alone cannot decide authenticity: Royal Mail and DHL both document genuine customs-payment messages. Check the organisation’s exact policy, then verify through its official app, website or a number you already trust. Never move money because a caller says it needs protecting.
Checking a UK government message? Our HMRC, DVLA, DWP and NHS text-message guide explains each organisation’s published rules and the independent route to use for verification.
If you only remember one thing, make it this: go to the source yourself. Impersonation only works while you stay inside the scammer's channel — their link, their number, their app. The moment you reach the company the way you normally would, the illusion collapses. For a specific message you can run through our scam checker, or check a suspicious text against your country's tool below.
Correction · 21 October 2026: We re-read every entry against the organisation’s own page. Fourteen entries said more than, or something different from, what that page says, and are now corrected to its current wording: the IRS, HMRC, Google, Microsoft, PayPal, Coinbase, FedEx, DHL, UPS, Meta, Zelle, Venmo & Cash App, Interac and the Austrian tax and customs entry. Four more are re-sourced because the cited page had moved or gone, and the rest are tightened to each organisation’s exact wording. Details are on our corrections page. This live correction does not amend the archived dataset version.
Correction · 20 September 2026: Royal Mail’s entry and the delivery FAQ now include its documented customs-fee text exception. The earlier blanket claim about payment links was incorrect. This live correction does not amend earlier archived dataset versions.
How this index is built
The index summarises published guidance on how an organisation contacts people and how to verify doubtful requests. Entries draw on the provider's security or help page, or a named regulator, and include our verification guidance. Each row links its source so readers can check the current policy and its limits.
We chose the entries by impersonation frequency, not by size — these are the names that actually appear in scam messages: banks, tax authorities (IRS, HMRC, CRA, ATO, Revenue), couriers (USPS, Royal Mail, Canada Post, An Post, DHL), payment apps, the big tech, streaming and crypto platforms, and the retailers most named in shopping-season scams (Amazon, Walmart, Target, Best Buy, Costco, eBay, Etsy, Shein and Temu, added 22 October 2026 ahead of Black Friday).
What counts as an entry. The index has 36 entries, and an entry is not always a single company. Five group bodies that scammers use interchangeably and that publish the same position — Venmo & Cash App, Australia Post & Linkt, ATO & myGov, Zoll, Finanzamt & Österreichische Post, and Meta (Facebook & Instagram) — so the 36 entries cover roughly forty named organisations and one named individual.
One further entry, your bank (any bank), is deliberately generic: the never-statement holds across retail banks, so naming one would imply the others are different. We count entries rather than companies because that is what the data actually contains.
Why there is only one public figure in it. The bar for entry is a never-statement the party has published itself, and almost no public figure publishes one — which is exactly why celebrity-impersonation adverts work. Martin Lewis is the exception, and by MoneySavingExpert's own analysis of Action Fraud reports he is also the most impersonated name in UK scam adverts: 1,151 mentions, 32.4% of all celebrity mentions (3,551 in total) in reported scams covering 165 public figures in 2022 and 2023, ahead of Taylor Swift (21.7%) and Elon Musk (13.9%).
MSE notes those figures are "likely to just be a drop in the ocean" because most scams go unreported. Swift and Musk are impersonated far more often than they are quoted saying so, and we will not write a never-statement on anyone's behalf.
Where a company publishes an exact line, we keep it verbatim; where it does not, we paraphrase its documented guidance and attribute it. We deliberately record the nuances rather than flatten them — DHL, for instance, genuinely does sometimes collect customs duty, so the honest guidance is to verify on dhl.com rather than to assume every courier fee is fake. Temu’s help centre served us only its Serbian-language edition, so its entry paraphrases that page and quotes only its sender domains and reporting address.
Last reviewed October 2026. Companies update their security pages; each row links the source so any entry can be re-checked and corrected.
For journalists
This index is free to cite, with credit (CC BY 4.0). It contains 36 sourced entries describing contact policies, prohibited requests and independent verification routes. Policies differ by organisation and message type; some genuine messages include payment or deposit links. Consult the specific source and verify the particular request before treating a channel or link as proof.
The dataset is archived with a permanent DOI, so it stays citable and resolvable independently of this site: 10.5281/zenodo.21453980 (a concept DOI, so it always resolves to the newest version rather than pinning to one deposit). (CSV + JSON + methodology, 1.1.0).
The archive matches this page as of 22 October 2026. Version 1.1.0, deposited that day, holds all 36 entries: the Martin Lewis addition of 2 August 2026, the Royal Mail, Interac and generic bank corrections of September and October, the 21 October re-verification against each organisation's own page, and the Retail & shopping category. Version 1.0.0 (27 entries) stays available on Zenodo unchanged. Any later live correction appears here first and reaches the archive only with the next version, so cite the archive for its preserved version and this page, with an access date, for current guidance.
Suggested citation: Tutela Digitalis (2026). The Tutela Digitalis Impersonation Index (Version 1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.23559393
Need the underlying data, a correction, or a quote? Email press@tuteladigitalis.com. We publish corrections.
Common questions about impersonation scams
How do I know if a text or email from a company is real?
Check the provider's policy for that particular message and verify doubtful contact independently. A link alone is not proof of fraud: genuine Interac notices for transfers without Autodeposit can include deposit links, and some couriers document customs-payment notices. A familiar logo, sender name or expected payment is not authentication either. Open the genuine app or website yourself, or use a contact number you already know. Never move money because a caller says it needs protecting or share a sign-in code with that caller.
Will my bank ever text or call me to move money?
No. This is the most important entry in the index. No legitimate bank, and no police force, will ever tell you to move your money to a “safe account,” or ask you to read out a one-time passcode. The FTC's rule is blunt: no one legitimate will ever tell you to move or transfer your money to “protect” it. If a “fraud team” call pressures you to move money, hang up and call the number on the back of your card.
Does the IRS / HMRC / CRA text you?
Policies differ by authority and message type. Tax authorities are widely impersonated: the IRS says “We don't send text messages without your permission” and “We never email without your permission”; HMRC says it does text some customers, sometimes with a link to GOV.UK information or HMRC webchat, but only ever emails about a tax rebate from an address ending in hmrc.gov.uk; and the CRA says it will not send refunds by e-transfer or text message or demand payment by e-transfer, gift card or crypto. Requests for personal or payment information need independent verification. Open the official site or app yourself.
Aren't some courier “customs fee” texts real?
A customs-fee message is not automatically fraudulent. Royal Mail says it may send a customs-fee SMS or email as well as its grey card, DHL says customs duties and taxes are the only payments it requests by email or SMS, and FedEx says it may send a secure link to pay duties and taxes on an international package. An Post says it will never ask for customs on an item coming into Ireland through a link. Policies differ by courier, so open the courier’s official site yourself and check the tracking or fee there before paying.
Do Walmart, Target or Temu text you about orders or prizes?
Retailers differ, so check the one named in the message. Walmart says it doesn’t notify contest winners by text and doesn’t text about product recalls. Target may call, email or text to check a suspicious transaction, but says it will never ask for your password, Circle Card PIN or Social Security number. Costco says its emails come from a Costco.com domain, and Temu says it won’t ask you to pay extra fees by email or text after you order. Check any order, prize or fee in the retailer’s own app or website, never through a link in the message.
What's the one rule that covers every company?
Verify doubtful contact through an independently opened official app, website or known phone number before acting. Organisations have different message policies, so a link alone cannot authenticate or condemn a message. If an account or payment may already be compromised, contact the affected institution promptly through that independent route.
Is this index legal or security advice for my specific case?
No — it's a general reference, aggregated from each organisation's own published security guidance and reviewed periodically. Companies update their policies, and scams evolve, so always confirm with the company through its official channel. If you're unsure about a specific message, you can ask us for a free, confidential second opinion.