howtobedigital

Learn → Digital Skills

Draft · not yet published

This lesson has been drafted but it has not yet met the bar on the how this is made page. Craig has not yet performed every step on a real machine, and the time on it is a planned estimate rather than a measured one. Until both are done, it does not carry a signature.

LESSON 07 · DIGITAL SKILLS

15 MINUTES (PLANNED, NOT YET MEASURED) · LAST CHECKED 27 JULY 2026

Tell a real message from a fake one

Fake messages are written by people whose full-time job is writing fake messages. Being taken in by one is not a sign of anything about you. What follows is four checks, in the order that catches the most with the least effort.

After this you will be able to

Check whether a message asking you to do something is genuine, and report it if it is not.

Skip this if you already check the sender's full address rather than the display name, and you know where to forward a suspicious message.

What you need

Steps

  1. Before anything else, notice the feeling. Nearly every fake message is trying to make you feel one of three things: hurried, frightened, or lucky. Your account will close today. There is a warrant out. You have won something.

    You should be able to name which of the three this message is going for. If it is going for none of them, it is more likely to be genuine.

  2. Look at who sent it, properly. On a phone, tap the sender's name at the top. On a computer, click or hover on the name. You are looking for the full address, not the display name, because the display name can say anything at all.

    You should see the full address, something like a name followed by an at-sign and a domain. Read the part after the at-sign. “hsbc-secure-alerts.net” is not “hsbc.co.uk”.

  3. Look at the link without touching it. On a computer, rest the mouse pointer on the link and read what appears at the bottom of the window. On a phone, press and hold the link — do not tap it — until a panel appears showing the address, then close the panel.

    You should see the real address the link goes to. If pressing and holding opens the page instead, you pressed too briefly and tapped it. Close the page without typing anything.

  4. Now the check that decides it. Do not use any contact detail in the message. Go to the organisation yourself, the way you normally would — the app on your phone, the number on the back of your card, the address you have used before — and ask them whether they sent it.

    You should be in touch with the organisation through a route you chose. This single step catches almost everything, and it is the one people skip because it takes longer.

  5. If it is fake, report it. Forward a suspicious email to report@phishing.gov.uk. Forward a suspicious text to 7726, which is free. GOV.UK gives both.

    You should see the message go into your sent items, or the text send with no charge. You will not get a reply, and that is normal.

    GOV.UK, Avoid and report internet scams and phishing, checked 27 July 2026

  6. Then delete it, and stop thinking about it.

    It should be gone from your inbox. There is nothing else to do.

If it goes wrong

The address after the at-sign looks right but something still feels off.
Trust that. Addresses can be faked well. Step 4 does not depend on the address being wrong — go to the organisation yourself anyway. It costs five minutes.
You already clicked the link.
Clicking alone is usually not the damage. Typing is. If you entered a password, change that password now on the real site, and change it anywhere else you used the same one. If you entered card details, phone your bank using the number on the back of your card.
On a phone, pressing and holding the link opens the page.
You lifted your finger too early. Close the page without typing anything into it and try again with a longer hold. Nothing has gone wrong.
It is a text and there is no link, only a number to ring.
The same rule holds. Do not ring the number in the message. Ring the organisation on a number you already have.

Do today

Find one message in your phone or inbox that you were not sure about. Do step 2 on it: read the sender's full address, not the display name. Then decide, and either report it or delete it.

Download the practice card (one page, A4, PDF). No email address. No account. Print it, copy it, hand it out.

Sources used on this page

DfE · Being safe and legal online, Entry Level 3 to Level 1 · source

Written by · Craig Stanley · drafted 27 July 2026 · not yet signed

When this lesson is published it will carry a name, a published date and a last-checked date. It does not carry one yet, and this page says exactly what that signature means.