Your phone lights up with a text saying you have won a Premium Bonds prize, or an email asks you to “verify” your NS&I ISA before money can be released. A genuine-looking contact can still be a scam.
NS&I security scams can involve email, text, phone calls, WhatsApp, post or fake websites. NS&I will not ask for passwords, one-time codes or full banking details through an unexpected contact.
Stop, close the message or end the call, and check NS&I independently. Type the NS&I address you know into your browser and sign in there; never use a link, advert or sponsored search result.
Compare the request, not the logo
A convincing logo proves nothing: focus on what the contact asks you to do.
| Contact type | A legitimate message may include | NS&I should not unexpectedly ask for | Safe check |
|---|
| Email | Service information or account prompts | Password, full bank details or a login through its link | Open NS&I by typing its address yourself |
| Text or WhatsApp | A short service alert | A code, urgent transfer or payment to release a prize | Do not reply; check the account directly |
| Phone call | A call you expected after arranging it | One-time passcode or remote access to your device | End the call and use an official contact route |
| Letter | Account-related post | A payment or details via a printed suspicious number | Find contact details on the official website |
Check prizes without the link
NS&I will not require a fee to release a Premium Bonds prize. Close any prize message and check the results only after accessing NS&I directly.
Use this order every time: close the contact, type the official website address yourself, sign in there, then check whether the alert, prize or request exists inside your account.
Many NS&I phishing scams rely on small warning signs rather than obvious spelling mistakes. In NS&I scam emails, check the full sender address, not just the display name, and be wary of generic greetings, unexpected attachments, shortened links or wording that says your account will be blocked unless you act immediately. A supposed Premium Bonds prize scam may promise a payment but direct you to an unfamiliar page or ask for a fee, bank details or a code.
The same caution applies to NS&I text message scams and WhatsApp scams: effective smishing protection means not tapping links, replying or calling numbers contained in the message. Genuine account information can always be checked by navigating to NS&I independently.
Spot fake calls, sites and letters
Judge the action requested, not how professional the contact looks. Phishing uses fake emails or websites, smishing uses texts, and vishing uses calls.
Treat caller ID as untrusted
A phone can display a real NS&I number even when NS&I did not make the call. End unexpected calls requesting a password, bank details, a one-time passcode or access to your device; use an official contact route instead.
Check the website address
A padlock and “https” do not prove that a website belongs to NS&I. Leave if the address has extra words, misspellings or an unusual ending, and never trust a login page reached through an advert, email, text or social-media post.
Act based on what you shared
Match your response to what happened, because deleting a message is not enough after sharing details or money. Act immediately if you entered credentials, disclosed a code or made a payment.
1. No interaction
Report, delete, check directly.
3. Shared details
Change access and contact NS&I.
4. Sent money
Call the bank immediately.
If you only received it
Forward suspicious texts to 7726 and emails to [email protected], then delete them and report the impersonation to NS&I through its official website.
If you entered details or paid
Change your NS&I password from a trusted device, make it unique and check account activity, contact details and linked bank details. If you gave bank details, a card number, passcode or sent money, call your bank immediately using its official app or the number on your card. After contacting the bank, report missing money, exposed identity details or account access through Report Fraud in England, Wales and Northern Ireland. In Scotland, report fraud to Police Scotland.
These checks help with contacts pretending to be NS&I, but they do not replace instructions from another genuine bank or provider. If a transfer is in progress, there is unauthorised access, or money or identity is at immediate risk, contact the bank urgently and report the matter through Report Fraud where appropriate.
If you clicked an email phishing link but did not enter anything, close the page, update your browser and device software, and run a security scan if a file was downloaded or the page asked you to install software. If you typed a password into a suspicious login page, change that password immediately from a trusted device and change it anywhere else it has been reused. Treat a request for a login code as a one-time passcode scam: the code can allow a criminal to complete a sign-in or payment.
For NS&I phone scams and vishing calls, caller ID spoofing can make a familiar number appear on screen. Hang up, wait before using the phone if you are concerned the line may still be open, and call NS&I through contact details you find yourself. A fake NS&I website or convincing call is never proof that the request is genuine.
Good online savings security is an ongoing habit, not just a response after a suspicious message. Use a long, unique password for your NS&I account and protect the email address linked to it with its own strong, unique password and available sign-in security. Keep your phone, computer, browser and security software updated, use a screen lock, and avoid signing in on shared or public devices. Check NS&I account activity, contact details and linked bank details regularly so unexpected changes are noticed quickly.
These simple routines strengthen Premium Bonds security too: check prizes through direct navigation or official account access, and never rely on an unexpected email, text, call or social-media message as proof of a win.
Common questions
Can NS&I send me a text message?
NS&I can send service messages, but a text is not proof it is genuine. Check your account directly.
Can NS&I ask for a one-time passcode?
NS&I should not ask for a one-time passcode during an unexpected call, email or text exchange.
Why have I received a letter from NS&I?
A letter may concern an account, prize or service matter. Verify doubtful post through official contact details.
Is an NS&I website with a padlock safe?
No. A padlock protects the connection, not the identity of the website.
What should I do if I sent money to an NS&I scam?
Call your bank immediately and ask about stopping or recalling the payment, then report it to NS&I and Report Fraud.
Should I report a scam text to 7726?
Yes, forward it to 7726 before deleting it so mobile providers can help identify scam messages.
What matters most:- Check NS&I only through direct navigation, never through an unexpected link, advert or callback number.
- Caller ID, branding, a padlock and polished wording cannot prove a contact is genuine.
- Report texts to 7726 and emails to [email protected], then delete them.
- Contact the bank first when money, bank details or a passcode has been shared.
Related sources
These articles can help you explore the topic in more depth:
