A bank name or a familiar message thread does not prove who sent a text. Choose the claimed sender and answer two questions for its published guidance and safer ways to verify. Free, anonymous, nothing to install.
Do not act on an unexpected request until you verify it independently. Genuine HMRC and Royal Mail messages can contain links; a link alone does not prove fraud. Open the organisation’s official app or website yourself. Never move money to a ‘safe account’ on a caller’s instructions.
A bank name on a text is not proof of origin. The UK has not mandated a central sender-ID registry; its new provider duties have two start dates.
Same inbox, different protections. SMS and MMS are covered. WhatsApp and iMessage sit outside this package, under a separate online-safety framework. RCS coverage depends on how the service is implemented. An ordinary mobile number does not establish who sent a message.
Source: Ofcom’s final statement, sections 2.31–2.36 and 9.14. Dates describe requirements, not a guarantee that every scam is blocked.
Compare the UK with other countries in the Scam-Text Protection Index →
Sender names and message threads can be imitated. What matters is checking the request through a route you already trust. HMRC lists genuine texts, including some refund updates; Royal Mail documents customs-fee messages containing a payment link. Those exceptions make blanket ‘every link is a scam’ advice unreliable. The checker gives guidance, not a definitive verdict on a message it cannot see.
The most common UK versions are a fake HMRC, DVLA or Royal Mail message and the bank ‘safe account’ call. Each one is engineered to create a small panic — a missed parcel, a tax deadline, a blocked payment — and a link that ‘fixes’ it in seconds. The fix is the trap.
For a message claiming to come from HMRC, DVLA, DWP or the NHS, compare the sender’s published contact rules in our UK government-text guide. Each organisation uses different channels, so check the one named in your message.
Here is where the UK differs from almost everywhere else. Since October 2024, banks and payment firms are required to reimburse most victims of authorised push payment (bank-transfer) scams, usually within five business days. It isn’t automatic, and there are limits and exceptions — but it makes the UK one of the only countries where being deceived into paying can still end with your money returned. If you’ve already paid, see whether banks refund scammed money and the country-by-country refund-rights index, and be ready for the follow-on ‘recovery’ con that targets people who’ve just lost money.
HMRC does send genuine texts, including some refund updates and payment reminders. Its published list includes P800 refund reminders without links and messages linking to GOV.UK information or webchat. A text that asks for personal or payment information is a warning sign. Check the exact message type against HMRC’s current list and open GOV.UK independently before acting.
Royal Mail does sometimes text a link to its Fee to Pay service for a customs charge. It also sends a grey card, which may arrive a day or two later. That exception does not prove your message is genuine: open royalmail.com independently and check the tracking number before paying. Other couriers have their own policies.
A request to move money to a ‘safe account’ is a scam warning. Banks also send genuine alerts, and message formats vary. A sender name, link or blocked-payment alert alone cannot settle authenticity. Open your bank’s app independently or call the number on your card; never transfer money because a text or follow-up caller says it will protect your funds.
No. DVLA never sends texts or emails asking you to confirm your personal details or payment information, and it doesn't text a link to pay for vehicle tax or to 'claim' a refund. The 'your vehicle tax payment failed' or 'you're due a DVLA refund' text is built to capture your card details. Tax or check a vehicle only at gov.uk/vehicle-tax by typing the address yourself; a genuine refund is issued automatically by cheque or to the bank account on record. Forward scam texts to 7726 and report them at report@phishing.gov.uk.
7726 (it spells SPAM on a keypad) is a free shortcode most UK phone providers support — forwarding a suspicious text lets them investigate and block the sender. It doesn't open a case on its own. To report fraud, contact Report Fraud, the UK's national fraud and cyber-crime reporting centre, online or on 0300 123 2040 (in Scotland, report to Police Scotland on 101). Forward scam emails to report@phishing.gov.uk, and report HMRC-branded scams to phishing@hmrc.gov.uk.
Possibly — and the UK is unusual here. Since October 2024, banks and payment firms are required to reimburse most victims of authorised push payment (bank-transfer) scams, usually within five business days, up to a set limit. It isn't automatic and there are exceptions, but it makes the UK one of the only countries where the law puts the money back. Call your bank immediately, ask them to recall the payment, and make a reimbursement claim. For how this works and the limits, see our guide on whether banks refund scammed money and the refund-rights index.
Correction · 20 September 2026: We removed the claim that every unexpected text containing a link is a scam. Royal Mail documents a customs-fee exception, and HMRC lists genuine texts. The checker now recommends independent verification instead of a definitive verdict from two answers.
Guidance checked against the sources below. Click through to verify the current policy.