The most damaging moment in an NS&I scam can come before you enter a password: clicking a link in an email or text. Open NS&I only from a saved address or carefully checked search result, never from a message link, and report suspicious texts to 7726.
Stop fake NS&I log-ins before they start
Open NS&I independently and block copied-login traps immediately. Type nsandi.com into the address bar or use your own bookmark; check the full domain before entering a customer number, password or security detail.
Use one safe route every time
Save the official NS&I site as a bookmark after reaching it yourself. On a phone, use the browser address bar rather than an advert or email link; a convincing page can still be designed to steal your details.
Compare the channel and request
| Channel | Check before acting | Fraud sign |
|---|
| Email | Read the full sender address and access NS&I separately. | Link asks you to sign in, confirm a password or act urgently. |
| Text message | Treat the text as unverified, even when the sender label says NS&I. | Short link, prize claim, account block or request for a code. |
| Telephone call | Hang up and find NS&I contact details independently. | Caller requests a one-time passcode, password or bank transfer. |
| Login website | Use your typed address or personal bookmark. | Address differs from nsandi.com or arrived through a message link. |
NS&I should not require passwords, security codes or full login details by email, text or telephone. A one-time passcode is a key that can approve access or payments.
NS&I phishing scams do not always use an obviously misspelt web address. A fake NS&I login page may use a lookalike such as a word added before or after the real brand, a hyphen, an unfamiliar ending or a misleading subdomain where “nsandi” appears on the left but the true domain is different. NS&I scam emails and NS&I text message scams can also lead to these pages through shortened links or paid search adverts.
For reliable nsandi.com verification, type nsandi.com yourself and check that the domain is exactly nsandi.com before entering any information. Do not rely on a padlock, a familiar logo or a high search ranking.
Check emails, texts and calls separately
Compare the request, not its appearance, and end contact that seeks a secret. Phishing emails, smishing texts and vishing calls use pressure and trust to make you act before checking.
Reject urgency and prize pressure
Hang up on callers requesting passwords, memorable details, passcodes, card details or transfers. Find contact details independently at the official NS&I website; never call back the displayed number.
Protect the email behind your account
Secure the email linked to NS&I before changing an NS&I password after suspected fraud. Use a unique password, enable two-factor authentication, and check recovery addresses, forwarding rules and recent sign-ins.
The safest response to any unexpected NS&I contact is to ignore its links and contact details, then reach NS&I yourself through nsandi.com. This rule still applies when a message knows your name, mentions Premium Bonds or displays a familiar number. If you have shared a password, code or payment information, secure the linked email account first, contact NS&I and your bank through official routes, then report the scam.
Email is not a safe place for account secrets. If you need to make a general enquiry, keep the message to the minimum needed, such as your name, preferred contact details and a brief description of the issue, and use an official address you found independently. Do not include a password, full login details, a one-time passcode, card information or copies of identity documents.
A secure email account is still important, but it does not make sensitive information safe to send in ordinary email. If NS&I needs account-specific verification, use its official sign-in route or an independently found contact channel instead.
Respond based on what you have done
Match your response to the furthest action you took and reduce harm now. Do not wait for proof if you shared a password, code, personal information or money.
Follow the action ladder
NS&I scam response ladder
Received only
Do not reply. Report email or text, then delete it.
Opened a link
Close it. Run device checks. Sign in only via nsandi.com.
Shared details or paid
Secure email, call bank and NS&I independently, then report fraud.
Report quickly when money is involved
Call your bank immediately if money has left your account, then contact NS&I independently and report the fraud. Keep screenshots, sender details, web addresses, times and payment references.
Keep enough evidence to make each report useful: save the sender address or phone number, the full web address, screenshots, the date and time, and any payment reference, but do not forward a malicious link to friends or colleagues. Forward suspicious emails to the NCSC’s reporting address, report scam texts to 7726, and report suspicious calls through the national fraud-reporting service if no money has been taken. For NS&I phone scams, vishing protection means ending the call rather than arguing with the caller.
If you entered bank details, approved a payment or sent money, contact your bank’s fraud team first; it may be able to stop or trace a transaction more quickly than a general fraud report.
Build a safer NS&I routine in England
Use a unique NS&I password, protect the linked email and return only through your own saved route. Each measure closes a different route used by criminals.
Make the device less useful to fraudsters
Install system and browser updates, use a screen lock, keep security software active and remove unknown browser extensions. Avoid signing in on shared devices or public Wi-Fi where possible.
Check access without using a message
After suspicious contact, sign in independently and check holdings, personal details and bank instructions. A padlock does not prove a website is genuine: fraudulent sites can use encryption too, so check the domain and how you reached it.
What people ask
Is it safe to send account details by email?
Never send passwords, one-time passcodes, full login details or a National Insurance number by email.
Are there scams involving NS&I Premium Bonds?
Yes. Check prizes only through NS&I’s official site, never through a text or email link.
Do NS&I send genuine text messages?
Possibly, but sender labels can be spoofed. Never sign in from a text link or share a code.
What should I do with an NS&I phishing email?
Do not click, download or reply. Report it to the NCSC, then delete it.
What if I clicked an NS&I text link?
Close the page, enter nothing, run a security scan and access NS&I by typing nsandi.com.
Can an NS&I caller ask for a security code?
Do not give a code to an unsolicited caller. Hang up and contact NS&I independently.
Is NS&I safe for savings?
NS&I is legitimate and government-backed, but backing does not make a fake message genuine.
Where do I report an NS&I scam in England?
Report texts to 7726 and emails to the NCSC; contact your bank first if money is involved.
Keep this NS&I safety plan ready
Use your own route to NS&I and treat every unexpected contact as unverified. Do not use links, do not share codes and act immediately if details or money may be at risk.
The essentials:- Open NS&I from your own bookmark or by typing nsandi.com, never from a message link.
- Passwords, one-time passcodes and full login details are secrets that should not be sent or dictated.
- Secure the linked email account before changing an NS&I password after suspected fraud.
- Report texts to 7726, suspicious emails to the NCSC, and contact your bank immediately if money is involved.
⚠️ Do not wait for a reply to a fraud report before contacting your bank or NS&I when credentials, identity details or money may be at risk.
Related sources
These articles can help you explore the topic in more depth:
