A convincing fake NS&I site can display a padlock, and pharming can redirect you even when you type the correct address.
Start NS&I safely: use a saved route, not search
Start every NS&I login from a saved bookmark or the official app, not a search advert, email or text link.
Use this three-check routine before every login or Premium Bonds purchase:
- Open NS&I from a saved bookmark or the official app downloaded from the Apple App Store or Google Play.
- Read the complete web address before entering any details, including every word before and after the main domain.
- Stop if the page unexpectedly asks for bank details, a password or a one-time passcode.
Is a Google advert safe for NS&I?
A sponsored result is not a safe route simply because it appears above unpaid search results. Fraudsters can buy adverts or create pages that resemble well-known savings brands, so the safer habit in England is to bypass search for routine account access.
Can you use the official app instead?
The official app can be a safer starting point if you installed it from an official store listing and keep it updated. Check the publisher and permissions before installing any financial app, especially if a text message has prompted you to download it.
For Premium Bonds, the England-specific limits are £25 minimum and £50,000 maximum per person. Those limits do not change the online safety checks: whether you hold £25 or £50,000, never give a caller a security code.
For stronger NS&I account security, create or register your account only after reaching NS&I independently through its official website or official NS&I app. A secure NS&I login should begin with your own saved route, not with a link sent after an unexpected call, email or text. Use a unique, long password that is not used for email or online banking, and enable any account login protection NS&I makes available. A genuine verification step may ask you to confirm a sign-in you started yourself, but an unsolicited request to read out or enter a security code elsewhere can be a one-time passcode scam.
Never share that code with a caller, even if they claim your account is under attack.
A padlock cannot stop a pharming scam
A padlock shows encryption, not that a website is genuinely run by NS&I.
How can pharming redirect a typed address?
Pharming may exploit harmful software, changed network settings or an unsafe connection that sends a web request to the wrong place. Unlike phishing, it does not always depend on you clicking a suspicious link first.
What should you check in the address bar?
Read the whole domain, not just the first word, the green padlock or a familiar NS&I logo. Watch for spelling changes, added words, strange endings and subdomains that put “NS&I” at the beginning but place the true domain elsewhere.
Your 60-second NS&I safety route
1. Start
Saved bookmark or official app
→
2. Check
Full domain, not just padlock
Good pharming scam prevention also depends on the device and connection you use. Keep your browser, phone operating system and official NS&I app updated, because updates can close weaknesses that malicious software or altered network settings might exploit. A password manager can improve saved bookmark security by opening the stored login address and refusing to fill credentials on a lookalike domain; it is not a substitute for website domain checks. Avoid a Premium Bonds online safety session on public Wi-Fi where possible, and use mobile data or a trusted home network instead.
Treat fake financial adverts, unusual browser warnings and security warnings about the padlock as reasons to stop: HTTPS encrypts a connection, but it does not prove that the site owner is NS&I.
Spot NS&I phishing, pharming and fake calls
Treat unexpected requests for passwords, one-time passcodes or bank details as scams until independently confirmed.
| Scam method | How it reaches you | Immediate safe action |
|---|
| Phishing | Email with a login link or attachment | Do not click; open NS&I from your bookmark. |
| Smishing | Text about a prize, block or refund | Do not reply; report and delete it. |
| Vishing | Caller claiming to be NS&I or your bank | Hang up; call an official number independently. |
| Pharming | A fake site loads through a diverted route | Close it; use a clean device and saved route. |
Would NS&I ask for a passcode by phone?
No. Treat any unexpected request to share a one-time passcode by phone as a scam, and contact NS&I independently through its official route if you are unsure.
What if you entered details on a suspect page?
Contact your bank immediately if you entered card or bank details, then change your NS&I password from a device you trust. Tell NS&I through its official contact route and report the fraud to Action Fraud{rel="nofollow noopener"}, the reporting service for fraud in England, Wales and Northern Ireland.
How do you reduce the chance next time?
Install browser, phone and app updates within a few days where possible, because updates often fix known security faults. Use a unique password for NS&I, turn on available account protections, and avoid managing savings on shared devices.
💡
You might be interested
A USB security key can add a physical check to compatible online accounts. It does not replace checking the NS&I web address, but it can reduce the risk from a stolen password.
- Requires a physical key for supported account sign-ins
- Can resist fake-site password capture on compatible services
- Provides a backup option separate from text-message codes
View options on Amazon →
This guide does not replace the urgent response needed for an account already compromised, an unauthorised payment or a device believed to be infected. In those cases, contact your bank first and NS&I through official channels. This is also not a comparison of returns, access to money or tax treatment between ISAs and Premium Bonds.
If you think you have used a fake NS&I website, act in a clear order. First, contact your bank using the number on the back of your card or in its official app, especially if you gave bank, card or payment details; ask it to secure the account and review suspicious transactions. Next, change your NS&I password and any reused passwords from an updated device you trust, and sign out of unfamiliar sessions where that option is available. Keep screenshots, the web address, messages and call details, but do not send passwords or codes as evidence.
Notify NS&I through its independently opened official contact route. Report suspected online banking fraud to Report Fraud, and forward suspicious texts to 7726 or report phishing emails and websites through the National Cyber Security Centre's reporting service.
What people ask
Is the NS&I website safe if it has a padlock?
No, a padlock only shows that the connection is encrypted, not that the website is genuinely run by NS&I. Check the complete domain and enter through a saved bookmark or official app.
Can pharming happen if I typed the address myself?
Yes, pharming can divert a typed web request to a fake website through altered device or network settings. Close the page if anything looks unusual and retry from a trusted device or mobile connection.
What should I do if I gave an NS&I scammer a code?
Contact your bank immediately, then change your NS&I password from a secure device and tell NS&I through its official route. Report the incident to Action Fraud if you are in England, Wales or Northern Ireland.
Should I use public Wi-Fi for Premium Bonds login?
Avoid logging into Premium Bonds on public Wi-Fi unless there is no safer option and your device is updated. Mobile data or your trusted home connection gives you fewer unknown network risks.
The essentials:- Start every NS&I visit from a saved official route, not an advert, text or email link.
- A padlock and HTTPS protect a connection, but they do not prove the site owner is NS&I.
- Never share a one-time code with a caller, even during a claimed fraud emergency.
- If details were shared, contact the bank first, change credentials safely, alert NS&I and report the fraud.
