You open an email about Premium Bonds or an NS&I ISA, see the familiar logo and a request to confirm details before signing in. HM Treasury backing protects eligible NS&I money, but it cannot stop phishing aimed at your login, email or device.
Summary of the process
Use official routes, protect your email and never share security codes.
- Open NS&I independently: type the address yourself or use your own bookmark, never a link in an unexpected message.
- Protect the linked email: use a unique password and two-step verification where available.
- Set a unique NS&I password: do not reuse one from banking, shopping or another savings account.
- Check your account details: keep your mobile number, email and postal address current.
- Stop and verify suspicious contact: use contact details found on the official NS&I website.
Step 1: verify the route before you log in
Use a route you control rather than a link supplied in a message.
Check messages without following them
Phishing emails may mention an unclaimed Premium Bonds prize, a blocked account or an urgent identity check; scam texts are called smishing and fraudulent calls vishing. Do not reply, call the supplied number or open the link: visit NS&I through your own browser route instead. Never read a one-time passcode to an unexpected caller, even if they claim to represent NS&I, your bank, the FCA or UK Finance.
Act in the right order if worried
If you entered a password, code or personal details, secure the email linked to NS&I first from a trusted device. Change its password, enable two-step verification, then change your NS&I password through the official site and check for unfamiliar contact or bank details. Email is often the route a criminal will use for password resets.
If a message or call feels wrong
1. Stop
No links or codes
→
2. Secure email
New password, 2-step
→
3. Visit NS&I
Type the address
→
4. Contact safely
Official details only
Spot a false NS&I sign-in page
A convincing NS&I login page can copy the logo, colours and wording of the official service, so do not judge a site by its appearance alone. Check the web address carefully before entering any details: spelling changes, extra words, unusual endings or a name that places “nsandi” within a longer address can all be warning signs. A padlock in the browser only shows that the connection is encrypted; it does not prove that the organisation behind the site is genuine.
For stronger phishing protection and NS&I login security, open the official NS&I website using a saved bookmark or an address you have typed yourself. If a page unexpectedly asks for more information than usual, closes your browser controls or creates pressure to act immediately, leave it and start again from your own route.
Step 2: lock down your NS&I access
Secure the password, email and device supporting your account.
Protect the email behind the account
Give the linked email account a unique password and enable two-step verification. Check its recovery address, mobile number and signed-in devices, removing anything unfamiliar. Use a long, unique NS&I password created with a password manager; never reuse it for email, online banking or retailers.
| Situation | Safe action | Avoid |
|---|
| Unexpected prize text | Open NS&I from your own bookmark | Tapping the text link |
| Password reset | Use a trusted, updated device | A shared computer |
| Call asking for a code | End call and find NS&I contact details yourself | Reading out the code |
This login advice does not solve an unauthorised payment, a loss involving another bank, or fraud affecting a different financial firm. Contact that bank or firm through its verified route as well, and consider reporting the matter to Action Fraud where appropriate. Official NS&I instructions may change, so they take priority over this guide.
Keep apps and devices under your control
The NS&I app can be a convenient way to manage savings, but app security still depends on the device it is installed on. Keep your phone or tablet updated, use a strong screen lock and do not share the unlock code, biometric access or account session with anyone else. Download or update apps only through the official Apple App Store or Google Play store, rather than from a link in an email, text or advert. Avoid signing in on a shared computer, and sign out if you have used a device that another person can access.
If a phone is lost or stolen, use its remote-lock or remote-wipe feature where available, change important passwords from a trusted device and review access to the email account linked to NS&I.
Check for changes after a suspected compromise
After changing passwords, review the account carefully rather than assuming the risk has ended. Look for unfamiliar changes to your postal address, email address, mobile number or nominated bank account, and check recent instructions, withdrawals or messages relating to your savings. Premium Bonds holders should also treat an unexpected prize notification as a possible Premium Bonds scam until it has been checked through an official route. If you cannot sign in, find details have been changed, or receive a password-reset message you did not request, begin account recovery through NS&I’s official channels and contact NS&I promptly using contact details you found independently.
Keep any suspicious email, text message or call details, but do not forward passwords, screenshots containing codes or one-time passcodes.
Frequently asked questions
Use these answers for common account-security checks.
Does FSCS apply to NS&I?
No, NS&I products are backed by HM Treasury rather than FSCS in the usual way. Neither protection prevents phishing.
How do I open an NS&I account online safely?
Type the official NS&I address into your browser, create a unique password and avoid links in messages, adverts or social-media posts.
Can NS&I call and ask for a code?
Treat an unexpected request for a password or one-time passcode as suspicious. End the call and find NS&I contact details independently.
Are old NS certificates worth anything?
Some old National Savings Certificates may still hold value. Check them through official NS&I channels, not an unsolicited valuation message.
Is public Wi-Fi safe for NS&I?
Do not use public Wi-Fi to change details, reset a password or enter security codes. Use home Wi-Fi or mobile data instead.
The essentials:
• HM Treasury backing protects NS&I savings differently from FSCS, but it does not stop fraud.
• Secure the email linked to NS&I before changing passwords after a suspected compromise.
• Type the official NS&I address yourself instead of following unexpected links.
• Never give a caller a password, security code or one-time passcode.
• Use trusted devices and connections for changes to savings or contact details.
Further reading
If you want to learn more about this topic, these sources may interest you:
