Scam & Junk Emails

• A reply proves your address is real. Most of these go to addresses no one reads. Yours replied, so it's now on a list of "confirmed" addresses, which is worth more and gets sold on. Replying brings more junk, not less.
• It starts the sales machine. The first email is only bait. A reply of any kind, even "no thanks", moves you on to follow-ups, "free audits", phone calls and invitations to "jump on a quick call".
• "Please remove me" doesn't remove you. Genuine companies you've signed up with will honour an unsubscribe. People who emailed you out of the blue treat it as proof someone is listening. Don't click "unsubscribe" in emails from people you've never dealt with, either: it does the same thing, and the link can lead somewhere harmful.
• They aren't who they say they are. There's usually no company name, address or phone number you could check, only a free email account. If you pay them, there's no one to complain to. Some will ask for your website or hosting login so they can "fix" things. Never give it to anyone except us.
• It costs you time, and they get nothing worth having. You won't change their mind or teach them a lesson. Their software sends the next thousand emails while you're typing.

1. Does it use your name? "Hi there", "Dear Website Owner", or your web address where your name should be means it was sent to a list, not to you.
2. Who really sent it? Tap or click the sender's name to see the actual email address. "Google Support" writing from a @gmail.com address is not Google. A real company writes from its own web address.
3. Where does the link really go? On a computer, rest the mouse over the link (don't click) and the real address appears at the bottom of the window. On a phone, press and hold the link. If it isn't the company's own website, don't go there.
4. Is it rushing or scaring you? "Final notice", "within 24 hours", "your account will be deleted", legal threats. Real organisations give you time. Pressure is there to stop you thinking.
5. Is it asking for a password, a payment or new bank details? Stop. Contact the company yourself, using a phone number or website you already know, not the ones in the email.

1. Don't reply, click any link, or open any attachment. You don't even need to read to the end. The first line usually tells you all you need.
2. Move it to Junk. This keeps your inbox tidy, and in some apps it helps the filter spot the next one.
   • iPhone / iPad Mail: swipe left on the email, tap More, then Move to Junk.
   • Mac Mail: select it and click the Junk button (the bin with an X) in the toolbar.
   • Gmail app: open it, tap ⋮ (top right), then Report spam or Move to → Junk.
   • Outlook: select it, then Report → Report junk (or Junk → Block Sender in classic Outlook).
   • Webmail: select it and move it to the Junk folder.
3. Delete it and move on. Blocking the sender is fine but rarely helps much: these are sent from a new address every time.
4. Report the dangerous ones. If an email pretends to be from a real organisation (a bank, HMRC, Royal Mail, Microsoft, Google and so on), forward it to the National Cyber Security Centre at report@phishing.gov.uk. Scam text messages can be forwarded free to 7726.
5. Still not sure? Ask us. If an email worries you, or seems to know something about your website, send it our way and we'll tell you whether it's anything to worry about. It's never a silly question.

Looking for a genuine email that has gone missing? Check your Junk folder now and then: filters occasionally catch real messages too.

I only replied

No real harm done. Don't reply again, and move any follow-ups to Junk. Expect a few more for a while, then they'll give up.

I clicked a link but didn't type anything in

Usually fine. Close the page. If something downloaded, don't open it: delete it. If your device starts behaving oddly, let us know.

I typed my email password into a page

Contact us straight away or phone us, and we'll change the password and check your mailbox isn't being used to send spam. Then update the new password on your phone and computer using our email setup guide. If you use the same password anywhere else, change it there too.

I gave someone my website or hosting login

Contact us right away. We'll change the passwords and check the website hasn't been tampered with.

I paid, or gave my bank or card details

Phone your bank immediately. Calling 159 from any phone puts you through to the fraud team at most UK banks. Then report it: in Scotland, call Police Scotland on 101.

I opened an attachment

Run a full virus scan (Windows Security on a PC is fine) and change your email password from a different device. If it was a computer you use to look after your website, tell us too.