Phishing, spam and nuisance calls: a UK protection guide

A text claims to be from your bank. A caller offers insurance for your washing machine. A letter arrives in your name for a debt you never took on. These are three different problems, handled by different organisations, yet they often start from the same place: someone has your personal details and wants to use them. This guide brings together what the National Cyber Security Centre (the NCSC) and the Information Commissioner's Office (the ICO) say about phishing, nuisance calls and identity theft. It sticks to those pages. Where they do not give a detail, such as a reporting number or a step, we say it is not specified rather than fill the gap.

What to do first

If something suspicious has just reached you, this is the order that the sources support.

1. Do not give anything away. The ICO advises that if you receive unexpected contact asking you to confirm personal information and you are uncertain, you should not provide any information and should get in touch with the organisation using the contact details it has already given you.
2. Report the attempt. The NCSC has separate reporting pages for emails, texts, phone calls, websites and adverts.
3. If you already shared personal information, go to the NCSC page on what to do next. The page we used does not reproduce those steps, so we cannot list them here.
4. If the contact was an unwanted marketing call, report it to the ICO, and register with the Telephone Preference Service if you have not done so.
5. If you see signs that your identity is being used, act quickly, as the ICO urges, and follow the steps in the identity theft section below.

The rest of this guide explains each of these in turn.

What phishing is and why it works

The NCSC describes phishing as criminals using scam emails, text messages or phone calls to trick their victims. The aim is often to make you visit a website, which may download a virus onto your computer, or steal bank details or other personal information.

The NCSC guidance also lists websites and adverts among the things you can report, so the same tricks can reach you through more than one channel.

Why your own information matters

One point from the NCSC is easy to overlook. Criminals use information about you that is available online, including on social media sites, to make their phishing messages more convincing. A message that uses your name, your employer or your recent activity looks more credible than a generic one. This is why reducing what is visible about you is a protection, not only a privacy preference. We return to this below.

Why you should report phishing

The NCSC's role

The NCSC is a UK government organisation. It has the power to investigate and take down scam email addresses and websites. That matters because a report is not simply a complaint filed and forgotten: it feeds into action against the sources of the scams.

The benefits the NCSC lists

The NCSC says reporting a scam is free and only takes a minute. By reporting phishing attempts, you can:

• reduce the amount of scam communications you receive;
• make yourself a harder target for scammers;
• protect others from cyber crime online.

The NCSC page also shows running totals of reports received and scams removed. We do not reproduce those figures, because they change over time and the page is the right place to read the current numbers.

The NCSC's reporting pages

The NCSC phishing page is a hub that points to more detailed guidance. It lists the following, each with its own page:

What the hub page does not say

The page we used is the first of several pages. It does not give the reporting addresses, numbers or step-by-step instructions, and it does not list the warning signs of a scam message. Those details sit on the linked pages. We have not invented any, and you should not rely on a number or address from a source that is not the NCSC itself. When in doubt, start from the NCSC website and follow its own links.

If you think you responded

Several of the NCSC pages explicitly cover the case where you already acted: you responded to a scam email, text or phone call, or shared personal information. The first step in that position is to open the relevant page instead of waiting.

Making yourself a harder target

The NCSC gives two practical suggestions that apply before any scam message arrives.

• Think about what personal information you, and others, post about you. The less a scammer can learn from public pages, the less convincing a fake message can be.
• Review the privacy settings in your social media accounts. The NCSC links this review to reducing the likelihood of being phished.

The ICO's identity theft guidance gives the same advice from another angle. It says that "less is more": the less you give away about yourself, the lower the risk of information falling into the wrong hands. It also asks you to think about what information you share on public or work devices.

Nuisance calls: what they are

The ICO defines nuisance marketing calls, also called spam calls, as unwanted phone calls that attempt to promote a product, service, aim or ideal to you where you have not given permission to be contacted. It describes two types:

• live marketing calls, which come from a real person you have not consented to receive calls from;
• automated marketing calls, which are pre-recorded marketing messages played when you answer the phone.

The ICO mentions recent news coverage of predatory marketing calls about white goods insurance, for example for a TV, washing machine or fridge. If you or your relatives were affected, it asks you to report it through its complaint pages.

Nuisance, silent, abandoned and scam calls are different

The ICO separates several kinds of unwanted call, and each goes to a different body.

The ICO states that it handles predatory, nuisance marketing calls. For scam calls it works closely with Report Fraud, and for silent and abandoned calls with Ofcom. The page we used says details on how to report silent, abandoned and scam calls appear on the ICO page itself, but it gives no phone numbers or addresses for these bodies, so we give none either.

How to protect yourself from nuisance calls

Register with the Telephone Preference Service

The ICO's first recommendation is to register your landline or mobile number with the Telephone Preference Service (TPS), free of charge. The TPS is a register of people who have said they do not want to receive marketing calls. The ICO presents it as the way to stop both live and automated marketing calls.

Report the calls that continue

Registering is not the end. The ICO asks you to report any nuisance calls you still receive, using its online reporting tool. It explains why this is worth doing: reporting cold calls, whether they played a recorded voice or came from a real person, helps the ICO stop nuisance marketing. The information you provide helps it investigate and take action against those responsible.

The consent exception

This is the most important limit on the TPS in the sources. If you agreed that an organisation could make live marketing calls to you, and you registered with the TPS afterwards, the organisation can still call you. To stop those calls, you need to contact the organisation directly and tell it to stop. A useful habit follows from this: be careful about the permissions you give when you sign up for something, because they may outlast a TPS registration.

Pension scheme calls

The ICO notes that there are strict rules on who can make a live marketing call about pension schemes. The organisation must be a trustee or manager of the pension scheme, or a firm authorised by the Financial Conduct Authority. Even then, it can only contact you if you have agreed to receive marketing calls. A caller who does not fit this description, or who has no permission to call, is one you can report. The ICO does not say more about how to verify a caller's status, so the sources do not tell you how to check an authorisation.

Premium rate numbers

Some calls ask you to phone a premium rate number. The Phone-paid Services Authority regulates products and services charged to users' phone bills or pre-pay accounts. You can contact it to report these calls or to access details of the premium rate number ranges it regulates.

If someone vulnerable is being targeted

The ICO gives specific advice where you or a relative are particularly vulnerable, for example with dementia or other underlying health conditions. Speak to your or their telephone network, which may have call blocking solutions. The ICO says many of these services are provided free of charge. Call blocker units are also available for purchase if needed.

What the ICO does about nuisance marketing

The ICO says it understands how distressing nuisance calls can be and that it is committed to protecting the public and stopping nuisance marketers. It lists several actions:

• it regularly meets companies to discuss their compliance with the law and monitors their improvement;
• it has the power to fine those who break the law, and says over £2.8 million in fines were issued to companies responsible for nuisance calls, texts and emails in 2021/22;
• it works with the Insolvency Service, which can disqualify rogue company directors;
• it publishes a monthly newsletter that highlights its action against nuisance marketers;
• it works closely with other regulators, with Ofcom on silent and abandoned calls and with Report Fraud on scam calls.

The page we used does not set out how long an investigation takes, and it does not promise that a report to the ICO will stop a given caller. Treat a report as a contribution to enforcement rather than a personal fix.

Texts and emails

The ICO's fine figure covers nuisance texts and emails as well as calls, but the nuisance calls page gives no separate instructions for them. For scam texts, the NCSC has its own reporting page.

Identity theft: what it is and how to spot it

The definition

According to the ICO, identity theft happens when your personal information, such as your name, date of birth, or current or previous addresses, is stolen and used by someone else to impersonate you. It can take place whether the victim is alive or deceased. If your identity is stolen, this can lead to identity fraud. You may lose money or find it difficult to get loans, credit cards or a mortgage.

One limit is stated at the start of the ICO page: the ICO cannot deal with cases of identity theft. It put the guidance together to help you and to point you to organisations that can provide advice and support.

Signs to look out for

The ICO lists these signs that you may be a victim of identity theft or identity fraud:

• important documents, such as a passport or driving licence, have been lost or stolen;
• mail from your bank or utility provider does not arrive;
• items you do not recognise appear on your bank or credit card statement;
• you apply for state benefits and are told you are already claiming;
• you receive bills or receipts for goods or services you have not asked for;
• you are refused financial services, a credit card or a loan despite having a good credit rating;
• you receive letters in your name from solicitors or debt collectors for debts that are not yours;
• your credit rating goes down even though you have not missed any payments or have no account in arrears.

The ICO says these signs mean you may be a victim, not that you are.

Reducing the risk of identity theft

The ICO's advice is practical and mostly offline. It asks you to:

• store documents carrying personal information, such as your driving licence, passport, bank statements, utility bills or credit card transaction receipts, in a safe and secure place;
• use a password manager to store your passwords in one place and fill them in automatically, so you do not have to remember them;
• shred or destroy old documents so that nothing showing your name, address or other personal details can be taken;
• regularly check your credit card and bank statements for suspicious activity, and monitor your credit report;
• when you move house, tell your bank, credit and store card providers, mobile phone provider and utility providers your new address, so new tenants cannot access letters containing your personal information, and consider redirecting your mail through Royal Mail;
• be wary about unexpected emails, calls or messages asking you to confirm your personal information.

Shopping online

The ICO adds three checks before you buy online. Use a secure website that displays the company's contact details. Look for a padlock symbol and a clear privacy and returns policy. Check that the web address begins with https. The ICO does not claim these checks make a site safe, only that they are things to look for.

If you are a victim of identity theft

The ICO tells you to act quickly, to limit the impact and prevent further losses. Its steps are:

1. Report all lost or stolen documents containing personal information, such as passports, driving licences, credit cards and cheque books, to the organisation that issued them.
2. Tell your bank, building society and credit card company about any unusual transactions on your statement.
3. Request a copy of your credit file to check for suspicious credit applications.
4. Report the theft of personal documents and suspicious credit applications to the police, and ask for a crime reference number.
5. Contact CIFAS, described by the ICO as the UK's Fraud Prevention Service, to apply for protective registration. Once you are registered, CIFAS members carry out extra checks whenever anyone, including you, applies for a financial service such as a loan using your details.

Where else to get help

The ICO lists further sources of advice:

• the GOV.UK guidance "What to do if you've shared personal information" on the Stop! Think Fraud site;
• Report Fraud, for England, Wales and Northern Ireland, or Police Scotland's advice and information for people who live in Scotland;
• the Financial Ombudsman Service;
• the Home Office identity theft victims' checklist;
• Report NHS Fraud, for England and Wales.

To report the theft or loss of post, the ICO names Royal Mail and gives a telephone number on its page. We do not repeat it here, so check the ICO page for the current contact details.

Who to contact: a summary

The three sets of guidance overlap, which can make it hard to know where to start. This table collects the bodies named in the sources.

How a free analysis fits in

Both the NCSC and the ICO make the same underlying point: what is known about you can be used against you. Remove Me offers a free analysis, with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (through Have I Been Pwned) and a register of data brokers, then shows you a report. The report is unlocked with a 6-digit code sent by email.

The analysis shows you what is visible. It does not stop phishing messages or marketing calls, and Remove Me does not yet send erasure requests on your behalf. Think of it as a way to see what a scammer or a cold caller could find, before you decide what to change, for example in your social media privacy settings.

What the sources do not cover

The three pages we used leave several questions open, and it is better to know where the gaps are than to fill them with guesses.

• The detail of the NCSC reporting steps. They sit on pages linked from the NCSC hub, which this guide does not reproduce.
• How to tell a scam message from a genuine one. The NCSC has a page for this. The page we used only points to it.
• Reporting numbers and websites. Only the bodies named above appear, with no addresses or short codes, and we have added none.
• Time limits. No deadline appears in the sources for reporting phishing, nuisance calls or identity theft, other than the ICO's general advice to act quickly if you think you are a victim of identity theft.
• Texts and emails that are not scams. The nuisance calls page deals with calls, and it does not set out a route for unwanted marketing texts or emails.
• Updated guidance. The ICO says its nuisance calls guidance is under review because of changes made by the Data (Use and Access) Act, so check its website for the latest version.

The overall picture from the sources is consistent. Phishing, nuisance calls and identity theft each have a named place to report, a free protective step you can take, and a set of habits that reduce your exposure: share less, check statements, and contact organisations through details you already trust. When something goes wrong, the advice is to act quickly and to use the right body for the right problem.