Pharming can send you to a fake site even when you type the right NS&I address. The real risk is trusting the page before checking its address.
Check an NS&I sign-in page before you log in
You should reach a real NS&I sign-in page through a route you already trust. Do not start from a link that arrived without warning.
A padlock does not prove ownership
A padlock means your browser connection is encrypted. It does not prove that the website belongs to NS&I.
A familiar name is not proof that a site is safe.
Check messages outside the message
A phishing scam uses an email or copied web page to make you sign in. A smishing scam uses a text message. A vishing scam uses a phone call.
Each scam can claim your NS&I account is locked. It may say Premium Bonds need urgent checks. It may also say a payment needs approval.
Do not use a link, callback number, or attachment from an unexpected message. Open NS&I from a bookmark or typed address instead.
Find contact details on the official website, not in the message. A real caller should not ask for your password, PIN, or one-time code.
Pharming can redirect a correct NS&I address
Pharming is the harmful redirection of a website address. You type the right address, but land on a fraudulent page.
Phishing, smishing and vishing differ
Phishing, smishing, and vishing try to make you act fast. Pharming is different because it can alter where a web address leads.
A false page can look very convincing. Check the full web address before entering any details.
The most common mistake is trusting a familiar logo. A logo is easy to copy, but the web address tells you where you are.
Make false redirection less likely
A password manager can help with this risk. It normally fills a saved password only on the exact domain it knows.
Use a strong, unique password of between 16 and 24 characters. You can also use three random words.
Never keep one-time verification codes beside your password. Treat these codes like a key that works only once.
🎯
Useful for this topic
A locked paper record can list household savings accounts and official contact details. Never write full passwords, PINs, or one-time codes in it.
- Keeps a simple list of NS&I and bank accounts for the holder or executor.
- Gives space for official website addresses and customer-service numbers checked independently.
- Reduces the need to search for account details during a stressful security incident.
Find on Amazon →
Use the same NS&I online security checks each time you sign in. Start from a bookmark, typed address, or an official app from an app store.
Check the full domain, not just the name in a message. HTTPS protects data while it travels, but it cannot prove an unknown domain is real.
Stop if the address has a spelling error. Stop if your browser shows a certificate warning or unexpected redirects.
Stop if an app requests permissions unrelated to account access. A changed sign-in design alone does not prove false redirection.
Online security promise: read the current terms
The NS&I Online Security Promise may help after unauthorised online activity. It is not blanket cover for every loss.
Protection is not the same as a guarantee
Report any transaction you did not approve straight away through NS&I's official fraud route. Fast reporting gives NS&I the best chance to check what happened.
A person who shared a password or code may face a different review. The result depends on the terms and evidence, not just the word “scam”.
Protection terms are not a licence to take risks.
Government backing is separate
Premium Bonds have backing from HM Treasury and the UK Government. That backing is separate from the rules for online fraud claims.
The practical reading of the Promise is this: report quickly, but do not take risks with security details. Check NS&I's live wording before relying on eligibility. Terms, reporting routes, and exclusions can change.
Read the current Promise before you need it. The next section shows how to react when something feels wrong.
Fraud response or technical fault: tell them apart
A failed login can be a technical issue. Treat unknown security changes as possible fraud until you check them.
Use this response table
| What you notice | Most sensible first step | Do not do |
|---|
| Password reset you requested | Reset only from the official site or app | Use the email link if you are unsure |
| Reset, code or contact change you did not request | Contact NS&I through its official route promptly | Reply to the sender or share a code |
| Details entered on a suspicious page | Change credentials safely and contact NS&I and your bank | Wait for a transaction to appear |
Act in the right order
If you entered details on a suspected false page, stop using it. Use a clean device if you can.
Change your password through the official route, then contact NS&I. Contact your bank's fraud team if bank or card details were involved.
In England, you can also report suspected fraud through the national reporting route. That report does not replace contacting the affected provider.
Acting early can limit further access to your account.
This advice is less relevant if you do not hold or use an online NS&I account. It also does not cover questions only about ISA or Premium Bonds investment features. It cannot replace NS&I's live fraud guidance, your bank's emergency process, or police action when money or identity data may be at risk.
If you suspect a pharming attack, deal with the incident in stages. First, stop entering information and take screenshots of the address, message, or warning.
Do not revisit the page. Instead, use a clean and updated device to change the affected password on the official site.
Review contact details and recent activity, then contact NS&I through its official fraud route.
If you reused that password elsewhere, change those accounts too. Start with email and banking accounts.
Watch for unknown password-reset messages or new payee requests. Keep a record of when you reported the problem.
This supports password reset security and limits further exposure. Knowing these signs helps you judge the next alert faster.
Your questions answered
Can a padlock prove a website is NS&I?
No, a padlock only shows that your connection to that website is encrypted. Check the full domain and reach NS&I through a trusted bookmark or typed address.
What does pharming mean for an NS&I account?
Pharming can redirect a correctly typed address to a fraudulent website. Browser warnings, unusual redirects and a changed page design are reasons to stop before entering details.
Is the online security promise automatic?
No, the Promise is subject to NS&I's current terms, eligibility rules and reporting requirements. Check the live official wording because customer-security duties and exclusions may affect a claim.
What should I do after sharing an NS&I security detail?
Contact NS&I immediately through its official website and change your password from a safe device. If you also shared bank details, call your bank's fraud team straight away.
Is a failed NS&I login always fraud?
No, a failed login can result from a forgotten password, a delayed code or a temporary lockout. An unrequested reset or unfamiliar contact detail is more concerning and needs checking.
Are Premium Bonds protected by the FSCS?
Premium Bonds are backed by HM Treasury and the UK Government rather than the FSCS. This backing does not mean every online fraud loss is automatically repaid.
Should I use public Wi-Fi to manage Premium Bonds?
Avoid public Wi-Fi for account changes, withdrawals or security resets where possible. Use your mobile data or a trusted home connection, with updated software and a screen lock.
Protect your NS&I account from today
The essentials:- Open NS&I through a trusted route, not an unexpected message link.
- HTTPS and a padlock help protect a connection but cannot prove site ownership.
- Pharming can send a correctly typed address to a fake destination, so watch for warnings and redirects.
- Read the current Online Security Promise terms and report suspected exposure without delay.
For a wider savings decision, compare how Premium Bonds and Cash ISAs differ. Check access, tax treatment, and how returns are paid.
Learn more
Here are some additional resources on this subject:
