Who to report a scam to, and what actually happens next
Last week we covered paying safely online and the warnings that protect your money before it leaves. This week is about what to do if it’s gone anyway: who to tell, in what order, and what happens after you press send.
The list they wished they’d had
A Greater Manchester law firm called us in last month after a fee-earner entered her Microsoft 365 password into a fake document-sharing page.
By the time they rang us, three people had already tried to help. The office manager had found “Action Fraud” in an old bookmark and wasn’t sure it still worked. A partner had rung the firm’s bank on the main switchboard number and was forty minutes into a hold queue. The practice manager had started a report to the ICO but didn’t know whether one was needed, or how long she had.
Nobody had done anything wrong. They just had no list, so the reporting happened in the wrong order, partly to the wrong place, and with nobody sure who was doing what.
We sorted it in half an hour. We secured the account first, checked the mailbox rules, ran an ICO assessment against the 72-hour clock, and filed one Report Fraud report with a crime reference number everyone could quote. Then we wrote the list they wished they’d had, and taped it inside the stationery cupboard.
Why this matters
Reporting works, even when it feels like nothing happens. More than 32 million suspicious emails have been reported to the NCSC’s Suspicious Email Reporting Service, leading to more than 329,000 scam website addresses being taken down (Crimestoppers, 2024).
For businesses, the question isn’t whether this happens, it’s when. The government’s Cyber Security Breaches Survey 2025/26 found 43% of UK businesses identified a cyber breach or attack in the past 12 months (GOV.UK, 2026).
The fix
Report Fraud is the UK’s national reporting service for fraud and cyber crime in England, Wales and Northern Ireland. It replaced Action Fraud on 4 December 2025, and the phone number, 0300 123 2040, hasn’t changed.
The service is run by City of London Police, and old Action Fraud links now redirect to it (GOV.UK, 2025). In Scotland, you report to Police Scotland on 101 instead.
The order you report in matters more than most people realise. Your bank can act within minutes to stop a payment or freeze an account. The police can’t. So if money has moved, the bank always comes first. Dial 159 from a different phone to the one the scammer contacted you on, and you’ll be put through to your own bank’s fraud team.
After that, the right place depends on what happened. Each one does a different job, which is why it’s worth telling more than one. For businesses, an IT provider who knows the order, and keeps the evidence intact while doing it, saves the scramble. That’s part of how we set clients up through Secure State.
Three quick wins you can act on this week
🏠 At home
If you’ve lost money, ring 159 straight away. Use a different phone if you can, in case the scammer is still on the line. Then report to Report Fraud online or on 0300 123 2040, and write down the crime reference number you’re given. Your bank may ask for it when you claim money back.
🏢 At work
Write a one-page reporting list: your bank’s fraud line, Report Fraud, your IT provider, your cyber insurer, and who decides whether the ICO needs telling within 72 hours. It’s the same page we suggested in the first hour after something goes wrong, with names added. If an attack is happening right now, call Report Fraud immediately.
🌍 For everyone
Report scams even when you haven’t lost anything. Forward scam texts free to 7726 and scam emails to report@phishing.gov.uk. Scam websites can be reported to the NCSC too. It takes a minute and helps get them taken down before they reach anyone else.
What happens after you report
- Report Fraud. You get a crime reference number, often within minutes. Your report goes to the police-run analysis service, which matches it against others (Report Fraud).
- Investigation decision. That can take up to 28 days. Reports with viable leads go to a police force. The rest become intelligence that helps target the criminals behind them.
- NCSC. Reported emails and websites are analysed. Malicious ones are removed with hosting companies. You won’t hear the outcome, but the NCSC acts on every message.
- 7726. Your mobile network traces where the text came from, and can block or ban the sender.
- Your bank. They can stop payments, add security to your account and handle claims to get your money back.
- ICO. For a business, if personal data is involved and there’s a risk to people, you must report within 72 hours of becoming aware.
Who to tell, and when
| What happened | Tell first | Then | What they do |
|---|---|---|---|
| Money has left your account | Your bank (159) | Report Fraud | Bank stops or recovers payments; police log the crime |
| Business under a live cyber attack | Report Fraud (0300 123 2040) | Your IT provider | Immediate police response; IT contains it |
| Suspicious email, no money lost | report@phishing.gov.uk | — | NCSC analyses and takes down |
| Scam text or call | 7726 | — | Network traces and blocks the sender |
| Personal data exposed (business) | Your IT provider | ICO within 72 hours, if notifiable | Regulator assesses the breach |
| Hacked account, no money lost | Your IT provider or the platform | Report Fraud | Account secured; crime logged |
What this looks like locally
We help businesses across Denton (M34), Ashton-under-Lyne (OL6), Stockport (SK1) and Trafford (M33) write their reporting list before they need it, including law firms, accountancy practices, manufacturers and charities. When the call comes in, the businesses with a list spend their first half hour fixing things. The ones without spend it on hold to the wrong number. You’ll find the rest of the series in our Weekly Tech Tips.
Frequently asked
Is Action Fraud still running?
No. Action Fraud was replaced by Report Fraud on 4 December 2025. The phone number, 0300 123 2040, stays the same, and old Action Fraud links redirect to the new service.
Who do I contact first if I’ve been scammed?
Your bank, if money is involved. They can act fastest to stop or recover payments. Ring 159 to reach your bank’s fraud team, then report the crime to Report Fraud.
Will the police investigate my fraud report?
They may. Decisions on whether to investigate can take up to 28 days. Many reports aren’t investigated individually, but they’re still used as intelligence to link cases and target the people behind them.
What is 159?
A free short number that connects you to your own bank’s fraud team, whichever bank you’re with. It’s for suspected scams only, not general banking queries.
Is it worth reporting a scam text if I didn’t click it?
Yes. Forwarding it to 7726 is free and lets your mobile network trace and block the sender before they reach anyone else.
When does a business need to report to the ICO?
When a personal data breach is likely to put people’s rights and freedoms at risk. You must report within 72 hours of becoming aware, even if your investigation isn’t finished yet.
“You might never hear back about your report, and that’s normal. It still gets added to everyone else’s. Enough of them together is what gets a scam shut down before it reaches the next person.” — Brett Casterton, Inology IT
Write the list before you need it.
I’m Brett at Inology IT. We’ll help you write a one-page reporting list for your business, make sure everyone knows who’s responsible for each call, and be the number your team rings first when something goes wrong. Drop your details below and I’ll come back to you the same working day.
Last reviewed by Brett Casterton, November 2026.