Check an NS&I message before you respond
NS&I will never ask for your password, full security details or a one-time code through an unexpected email, text or phone call.
| Contact or request | NS&I may do | NS&I will never do |
|---|
| Email or text | Send account-related information or ask you to visit the NS&I website independently. | Ask for your password, full security details or a one-time code. |
| Phone call | Contact you about administration or security. | Tell you to move money to a "safe account" or reveal a code. |
| Website link | Direct you to official information that you can also find independently. | Make an unexpected link the only way to protect your account. |
| Letter | Write about products, account matters or checks. | Require you to scan an unverified QR code or call an unverified number urgently. |
NS&I may contact you about account administration or security, products, account matters or checks.
What should stop me at once?
Stop if you are asked for your password, full security details or a one-time code, or if you are told to move money to a "safe account".
Fake websites and calls can copy trusted details
A padlock symbol or HTTPS does not prove an NS&I login page is genuine.
Check the web address before entering any detail. A genuine NS&I page should be reached by typing nsandi.com yourself or using a bookmark you created. A copied logo, correct colours and a padlock cannot make a lookalike domain safe.
Signs of a cloned login page
A false page may use an address with extra words, swapped letters, unusual endings or a long string before the real-looking name. Read the address from left to right, and do not rely on the large logo.
A spoofed number is made to appear on your screen as though it belongs to someone else. Returning the call to the displayed number can still connect you to the scammer.
Take the right action for what you shared
Your next step depends on the extent of your engagement with the suspected scam.
| What happened | Risk level | Do this now |
|---|
| You opened a message only | Usually low | Do not reply, click or download. Save evidence, report and block. |
| You clicked a link | Low to medium | Close it. Run a device security check if anything downloaded. Access NS&I directly. |
| You entered login or bank details | High | Contact NS&I and your bank through official details. Change passwords from a safe device. |
| You shared a code or sent money | Urgent | Call your bank fraud team immediately, then contact NS&I and report the fraud. |
If you only clicked the link
Close the page without entering anything. If you downloaded a file or app, disconnect the device from the internet if possible and get help from a trusted security professional.
🛒
Recommended product
A locked paper organiser can help keep account contact details in one place, rather than relying on a suspicious message. Do not record full passwords, banking details or security codes.
- Keeps independently checked NS&I contact routes easy to find
- Helps separate reference notes from passwords and one-time codes
- Provides a non-digital record if a phone or email is unavailable
View on Amazon →
If you gave a code or sent money
Call your bank using the number on its official website, app or the back of your card. Ask for its fraud team and explain exactly what you gave, when, and whether a transfer was made.
Report a suspicious text to 7726, which is the free reporting number used by UK mobile networks.
Keep evidence of suspicious messages before blocking contact. A paper letter can be genuine, particularly for account servicing or identity checks. Check it by finding NS&I contact details independently, rather than scanning its QR code or using its printed phone number.
If you transferred money, gave card or bank details, shared NS&I login credentials, or believe someone may access your account now, call your bank and NS&I immediately through independently found official details. If you are in immediate danger, call 999. This article cannot replace urgent support from your bank, NS&I, the police or emergency services.
Common questions
Do NS&I send text messages?
NS&I may send account-related texts, but a sender name showing “NS&I” is not proof of authenticity because sender IDs can be spoofed. Forward suspicious texts to 7726 for free, then block the number.
Do NS&I send emails?
NS&I can send emails about account administration, but you should not follow an unexpected link to sign in. Type nsandi.com into your browser and check your account there instead.
What if I gave my one-time code?
Contact NS&I and your bank immediately using independently found official details. A one-time code can be enough for a criminal to approve a login, reset access or authorise a payment.
Is an HTTPS padlock proof of a real NS&I site?
No, HTTPS only protects the connection to the website you reached. A fake website can also have HTTPS, so check the full domain and reach NS&I directly.
Can I report an NS&I phishing email?
Yes, forward the email to [email protected] without clicking links or opening attachments. If you entered any details, also contact NS&I and your bank on the same day.
