Impersonation is the world's most-reported scam — a text or email wearing a trusted name. The fastest way to break it is to know how that company really reaches you. Search a bank, government agency, courier, payment app, tech company or public figure below and see its own published position: how it contacts you, what it will never do, and how to check.
Check the provider's actual message policy, then verify independently. Genuine Interac notices without Autodeposit can include deposit links, and some couriers document payment notices. A link, logo or expected message cannot establish who sent it. Open the genuine app or website yourself, or use a known number. Never move money because a caller says it needs protecting or give that caller a sign-in code.
Correction · 9 October 2026: The Interac entry and page summary wrongly extended Autodeposit's no-security-question process to all genuine deposits. Manual-transfer notices can include deposit links. We also removed the generic bank rule forbidding every texted verification link. These live corrections do not amend the archived dataset. See the correction record.
Don’t see a company? The rule is the same for all of them: a real organisation never needs you to act through a link in an unexpected text or email. Go to the official app or type the address yourself. Not sure about a message? Ask us free.
Imposter scams are the most-reported fraud category year after year, and they all run the same play: borrow a name you trust — your bank, the tax office, a courier, Amazon, Apple — and use the trust that name carries to make you act before you think. The logo, the formatting, even the sender ID can all be faked. What can't be faked is the company's actual behaviour, and that's the one thing most people never check.
Organisations publish different rules for different messages. A link alone cannot decide authenticity: Royal Mail and DHL both document genuine customs-payment messages. Check the organisation’s exact policy, then verify through its official app, website or a number you already trust. Never move money because a caller says it needs protecting.
Checking a UK government message? Our HMRC, DVLA, DWP and NHS text-message guide explains each organisation’s published rules and the independent route to use for verification.
If you only remember one thing, make it this: go to the source yourself. Impersonation only works while you stay inside the scammer's channel — their link, their number, their app. The moment you reach the company the way you normally would, the illusion collapses. For a specific message you can run through our scam checker, or check a suspicious text against your country's tool below.
Correction · 20 September 2026: Royal Mail’s entry and the delivery FAQ now include its documented customs-fee text exception. The earlier blanket claim about payment links was incorrect. This live correction does not amend earlier archived dataset versions.
The index summarises published guidance on how an organisation contacts people and how to verify doubtful requests. Entries draw on the provider's security or help page, or a named regulator, and include our verification guidance. Each row links its source so readers can check the current policy and its limits.
We chose the entries by impersonation frequency, not by size — these are the names that actually appear in scam messages: banks, tax authorities (IRS, HMRC, CRA, ATO, Revenue), couriers (USPS, Royal Mail, Canada Post, An Post, DHL), payment apps, and the big tech, streaming and crypto platforms.
What counts as an entry. The index has 28 entries, and an entry is not always a single company. Five group bodies that scammers use interchangeably and that publish the same position — Venmo & Cash App, Australia Post & Linkt, ATO & myGov, Zoll, Finanzamt & Österreichische Post, and Meta (Facebook & Instagram) — so the 28 entries cover roughly thirty named organisations and one named individual. One further entry, your bank (any bank), is deliberately generic: the never-statement holds across retail banks, so naming one would imply the others are different. We count entries rather than companies because that is what the data actually contains.
Why there is only one public figure in it. The bar for entry is a never-statement the party has published itself, and almost no public figure publishes one — which is exactly why celebrity-impersonation adverts work. Martin Lewis is the exception, and by MoneySavingExpert's own analysis of Action Fraud reports he is also the most impersonated name in UK scam adverts: 1,151 mentions, 32.4% of all celebrity mentions across 3,551 reported scams naming 165 public figures in 2022 and 2023, ahead of Taylor Swift (21.7%) and Elon Musk (13.9%). MSE notes those figures are "likely to just be a drop in the ocean" because most scams go unreported. Swift and Musk are impersonated far more often than they are quoted saying so, and we will not write a never-statement on anyone's behalf.
Where a company publishes an exact line, we keep it verbatim; where it does not, we paraphrase its documented guidance and attribute it. We deliberately record the nuances rather than flatten them — DHL, for instance, genuinely does sometimes collect customs duty, so the honest guidance is to verify on dhl.com rather than to assume every courier fee is fake.
Last reviewed June 2026. Companies update their security pages; each row links the source so any entry can be re-checked and corrected.
This index is free to cite, with credit (CC BY 4.0). It contains 28 sourced entries describing contact policies, prohibited requests and independent verification routes. Policies differ by organisation and message type; some genuine messages include payment or deposit links. Consult the specific source and verify the particular request before treating a channel or link as proof.
The dataset is archived with a permanent DOI, so it stays citable and resolvable independently of this site: 10.5281/zenodo.21453980 (a concept DOI, so it always resolves to the newest version rather than pinning to one deposit). (CSV + JSON + methodology, 1.0.0).
The archived and live records differ. The archive is version 1.0.0 with 27 entries; this page holds 28 after the Martin Lewis addition on 2 August 2026. It also includes later live corrections, including Royal Mail's September customs-fee exception and the 9 October Interac and generic bank corrections. Those edits do not change the archived files, DOI or version. Cite the archive for its preserved version; cite this page with an access date for current guidance. A v1.1.0 redeposit remains pending.
Suggested citation: Tutela Digitalis (2026). The Tutela Digitalis Impersonation Index (Version 1.0.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.21453981
Need the underlying data, a correction, or a quote? Email press@tuteladigitalis.com. We publish corrections.
Check the provider's policy for that particular message and verify doubtful contact independently. A link alone is not proof of fraud: genuine Interac notices for transfers without Autodeposit can include deposit links, and some couriers document customs-payment notices. A familiar logo, sender name or expected payment is not authentication either. Open the genuine app or website yourself, or use a contact number you already know. Never move money because a caller says it needs protecting or share a sign-in code with that caller.
No. This is the most important entry in the index. No legitimate bank, and no police force, will ever tell you to move your money to a “safe account,” or ask you to read out a one-time passcode. The FTC's rule is blunt: no one legitimate will ever tell you to move or transfer your money to “protect” it. If a “fraud team” call pressures you to move money, hang up and call the number on the back of your card.
Policies differ by authority and message type. Tax authorities are widely impersonated: the IRS says “a letter or notice is the first way the IRS will contact a taxpayer,” HMRC says it never texts a link to claim a refund or make a payment, and the CRA won't text you a link to a refund or demand payment by e-transfer, gift card or crypto. Some HMRC refund-status texts are genuine; requests for personal or payment information need independent verification. Open the official site or app yourself.
A customs-fee link is not automatically fraudulent. Royal Mail documents customs-fee texts and DHL also collects genuine customs charges. Policies differ by courier. Open the courier’s official site yourself and check the tracking or fee there before paying.
Verify doubtful contact through an independently opened official app, website or known phone number before acting. Organisations have different message policies, so a link alone cannot authenticate or condemn a message. If an account or payment may already be compromised, contact the affected institution promptly through that independent route.
No — it's a general reference, aggregated from each organisation's own published security guidance and reviewed periodically. Companies update their policies, and scams evolve, so always confirm with the company through its official channel. If you're unsure about a specific message, you can ask us for a free, confidential second opinion.