UK Smishing Pattern 2026 — How SMS Scams Work and the 3 Rules That Defeat Them

Smishing in numbers: why the UK is the world’s smishing capital

UK Finance’s 2025 Annual Fraud Report attributed £460m+ in Authorised Push Payment (APP) losses to scams largely driven by SMS phishing. Report Fraud’s quarterly reporting puts smishing among the top three growing fraud categories by volume. The UK is disproportionately targeted globally because: high smartphone penetration; a regulated banking system whose fraud-alert SMS patterns are easy to clone; widely-spread expectation that legitimate organisations communicate by SMS (delivery notifications, GP appointments, gov.uk alerts); and a sender-ID system that doesn’t verify the sender.

The breadth is enormous — banks (Barclays, NatWest, HSBC, Lloyds, Santander, Halifax, Nationwide, Monzo, Revolut, Starling, TSB), couriers (Royal Mail, Evri, DPD, Yodel, Parcelforce, FedEx, UPS), government (HMRC, DVLA, DWP, NHS, council tax, TV Licence, passport office), big-tech (Microsoft, Apple, PayPal, Amazon, Netflix, Spotify), and emerging channels (NHS App, gov.uk verify, FCA “warning” texts). But the underlying mechanic is identical across all of them.

The 4-stage universal smishing pattern

Stage 1 — Sender-ID spoofing

UK SMS sender IDs are not authenticated. A criminal can send an SMS with the displayed sender set to “Barclays”, “HMRC”, “Royal Mail” or any other text. The recipient’s phone shows that text in the SAME thread as any genuine messages already received from that sender ID — because the phone groups messages by displayed sender, not by underlying source. This means a thread containing a real OTP from Barclays can also contain a scam text from “Barclays”.

Stage 2 — The pretext: fraud alert, delivery, gov.uk notification, account suspension

The message creates a reason to act. The dominant UK pretexts in 2026: (a) “Suspicious transaction of £X to Y” bank fraud alerts — the highest-loss category. (b) “Your parcel could not be delivered — pay £1.99 customs fee” courier scams. (c) “HMRC tax refund / DVLA licence update / NHS appointment fee” gov.uk impersonation. (d) “Your [Apple / Microsoft / Netflix] account is suspended”. The pretext is plausible because the recipient legitimately receives texts in all of these categories.

Stage 3 — Urgency + an action: call this number, or click this link

Time pressure suppresses verification. “Action required within 24 hours.” “Your account will be suspended.” “Pay within 12 hours or shipment returned.” Two action types: (a) a phone number to call — almost always for bank-fraud-alert variants, leading to the “safe account” script. (b) a link to click — almost always for courier / gov.uk / account-suspension variants, leading to a credential / card-harvest page on a typosquatted domain.

Stage 4 — The payload: “safe account” transfer, or credential / card harvest

For call-back variants: the “fraud team” confirms the (fake) suspicious transaction, then tells the victim to transfer money to a “safe account in your name” while the “investigation” runs. The safe account is the criminal’s; the money is gone the moment it lands. For click-link variants: the lookalike domain captures username + password + 2FA code, allowing real-time login to the victim’s online banking; or captures full card details for resale and immediate use. Either way, the smishing mechanic ends in money or credentials extracted within minutes of the victim engaging.

The 3 rules that defeat every UK smishing variant

The rules are simple and universal. Every UK smishing scam fails if you apply all three:

Rule 1 — Never call a number from an SMS. Ever.

If a text gives you a number to call, that number is the trap. Real banks, real couriers, real government departments, real tech companies always tell you to call them on a number you already know — the back of your bank card, the published number on the real website, your saved number from when you registered. If the SMS itself provides the number, the scam is the call. Hang up. Call the real organisation back on a number you trust.

Rule 2 — Never click a link from an unsolicited SMS. Ever.

If a text asks you to click a link — to verify your account, pay a fee, reschedule a delivery, confirm your identity, claim a refund — don’t. Type the organisation’s real domain into your browser yourself. Real organisations communicate through their app, posted letter, or known-domain website. If a real notification exists, you’ll see it when you log in directly. If you don’t see it, the SMS is fake.

Rule 3 — Never read a security code on the phone. Ever.

If you’re on a phone call and they ask you to read out an OTP, 2FA code, or security code that just arrived on your phone, you’re mid-scam. The whole purpose of the code is to prove YOU are authorising something. Reading it to a caller authorises THEIR transaction — on YOUR account. No legitimate organisation will ever ask for this. Hang up immediately.

What real organisations actually do via SMS in the UK

Banks: send informational alerts (transaction notifications, balance alerts, OTPs for transactions you initiated). They never instruct you to move money. They never ask for an OTP back. Real fraud-team contact is initiated by you, by calling them on the number on your card.
Couriers: send delivery-status updates and physical-card / yellow-tag notifications. Real customs / handling fees are paid via the courier’s own tracking page, not a separate SMS-link payment portal.
Government: sends appointment reminders (GP, hospital), tax-account notifications via the gov.uk Personal Tax Account dashboard, and DVLA letters by post. Real gov.uk notifications never include a payment link.
Tech companies (Apple, Microsoft, etc.): rarely use SMS for support contact at all. Account-related communications usually arrive via in-app notification or via email from their genuine domain. Real Apple / Microsoft never threaten 24-hour account suspension via SMS.

Brand-specific smishing guides (for your specific text)

If you have a text in front of you right now from a specific brand, jump to the corresponding guide:

Report the SMS to 7726 (the free UK scam-text reporting line)

7726 spells “SPAM” on a phone keypad. Every UK mobile network supports it (EE, O2, Three, Vodafone, Sky Mobile, Tesco Mobile, Lebara, GiffGaff, BT Mobile). Forward the scam SMS to 7726; you may receive a follow-up asking for the sender number (forward that too if asked). The text is forwarded to the National Cyber Security Centre (NCSC) and the mobile networks, who use the reports to block sender numbers and take down associated phishing infrastructure. NCSC reports taking down over 100,000 scam URLs each month using SERS + 7726 data combined.

If you’ve already engaged with a smishing scam

Called the number and were asked to transfer money: Hang up immediately and call your bank’s fraud line on the number on the back of your card. If you’ve already transferred, use the PSR Claim Wizard within hours — PSR Mandatory Reimbursement covers up to £85,000 within 5 working days for APP fraud.
Clicked a link and entered card details: call your bank’s fraud line, cancel and replace the card. Use the Chargeback & Section 75 Generator for any unauthorised transactions that have already cleared.
Clicked a link and entered banking credentials: change your banking password from a different device, sign out all sessions, enable 2FA via authenticator app. Notify your bank’s online-banking security team.
Clicked a link and entered personal details (DOB, NI number, address): register for CIFAS Protective Registration — £25 for 2 years of credit-file protection.
Forward the text to 7726. Even if you didn’t lose money, your report helps NCSC and the mobile networks block the operation.
Report to Report Fraud on 0300 123 2040 for any actual loss. Your case feeds the UK national fraud intelligence picture.

Use the Scam Message Scanner →

UK Smishing Pattern