Use the Aurelle Phishing Check to look for common warning signs before you click, reply, download anything or send money.
It takes about a minute. You won’t need to enter your email address or upload the suspicious message.
Free · No signup · No message upload
If you’re suspicious, don’t click links, open attachments, scan QR codes, reply to the message or provide personal or financial information while you check it.
This tool only asks about general warning signs. Please don’t paste suspicious links, passwords, bank details, authentication codes or other sensitive information into Aurelle Digital.
Answer based on the message you’ve received. It’s fine if you’re not sure.
Were you expecting this message?
Reporting helps the National Cyber Security Centre (NCSC) investigate and remove scam websites and messages. You don’t need to have lost anything to report a suspicious message.
Forward the email to report@phishing.gov.uk.
Forward the text to 7726 (free). Your network provider is then alerted to the number.
Report a scam website URL to the NCSC’s scam website reporting service.
Contact your bank immediately. Then follow the current official UK fraud-reporting guidance at reportfraud.police.uk.
Change it promptly — including anywhere else you’ve reused the same password. Then follow the NCSC phishing guidance.
For the full official guidance, see the GOV.UK page on avoiding and reporting internet scams and phishing.
Phishing messages try to look convincing. Many are well-written and carefully designed, so don’t assume a message is safe simply because it looks polished — and don’t assume it’s a scam just because it contains a typo. The patterns below are more reliable than surface details.
A genuine organisation rarely insists you act in the next few hours. Phishing messages often create artificial deadlines — "your account will be closed", "payment overdue", "you have 24 hours" — to stop you thinking clearly.
Banks, payment services and most legitimate companies will not ask you for your password, full card number, one-time security code or PIN by email or text. Treat any such request as a warning sign.
A message asking you to pay an unexpected invoice, move money to a "safe" account, buy gift cards or settle a delivery charge is a common scam pattern. Verify the request through a channel you trust.
Scammers often pose as a familiar brand, a colleague, a delivery company or a government body. The name or logo may look right, but the details — the address, the wording, the request itself — may be subtly off.
Check the full sender address, not just the display name. A message that looks like it comes from your bank may actually come from a slightly altered domain, a personal address, or a name with extra characters.
A link can display one name but point somewhere else entirely. On a computer, hover over the link to preview the address; on a phone, use the long-press preview if available. If the address is misspelled, unfamiliar or doesn’t match the organisation, don’t click it.
An attachment you weren’t expecting — an "invoice", a "document", a "form" — can carry malware. Even a file that looks like a PDF or spreadsheet can be something else. Confirm with the sender through a trusted channel first.
A QR code can send you to a website without showing you the address first. Treat QR codes in unexpected messages the same way you’d treat a link: don’t scan them unless you’re confident of the source.
Messages about a "suspended account", a "failed delivery", a "refund", a "prize" or a "security alert" are designed to make you log in or hand over details. If you’re unsure, go to the organisation’s app or website directly.
A message that asks you to pay into a different bank account, keep a request secret, avoid the usual website or skip a normal check is a serious warning sign — even if it appears to come from someone you know.
A note on spelling: modern scam messages are often grammatically correct and professionally laid out. Poor spelling alone doesn’t prove anything either way — judge a message on its requests and behaviour, not its style.
The safest check keeps you in control of where you go next.
Clicking a link doesn’t automatically mean you’ve been compromised. What matters next is what happened after the click. Work through the steps below.
Follow the current official guidance on the NCSC’s phishing: respond & recover page and the GOV.UK guide to avoiding and reporting scams and phishing.
The Aurelle Phishing Check is an educational tool designed to help you recognise common warning signs. It cannot inspect the message, sender, link, attachment or device, and cannot confirm whether something is genuine or fraudulent. If you’re unsure, verify the communication independently.
You might also find it useful to read How to Spot a Phishing Email or Text Message in the Aurelle Journal, or the entry for phishing in the Aurelle Glossary.
Aurelle Digital creates practical, plain-English guides for using technology with more confidence.
We use strictly necessary cookies for basket, checkout and account. We only load Google Analytics if you allow it. See our Cookie Policy.