What to Do If You Replied to a Scam Text

Replying to a scam text is a common mistake, and it does not mean you have lost money or that your phone is infected. What matters is what you do next. If you gave away a password, a one-time passcode or bank details, act now: change the password on that account and anywhere you reused it, and contact your bank immediately using the number on your card or its official website, not a link in the message¹.

If you only replied with a word such as "STOP" or "YES", the main risk is that your number is now confirmed as active, which can bring more messages and calls. Do not reply again. Forward the message to 7726, the free reporting service that passes scam texts to your mobile phone provider, and then delete it³.

The sections below take you through each situation in turn: what to change, who to call, how to report, and what to watch for in the days and weeks afterwards.

Change your passwords if you shared or reused any

If the scam text asked for a password and you typed it in, or if you replied to a message that quoted a password you still use, change that password now. The National Cyber Security Centre (NCSC) advises changing any password mentioned in a scam message immediately if you still use it, and changing your account password anywhere else you use the same one⁶. The reason is simple: if you use the same password across different accounts, criminals only need one password to access all of them⁸.

Start with your email account. If a criminal can get into your email, they can reach private information about you, including banking details, send messages pretending to be from you, and reset the passwords on your other accounts⁸. The NCSC advises that if you have reused your email password elsewhere, change it as soon as possible, and make it strong and different from all your other accounts⁸.

A few practical points:

• Change the password on the account that was exposed first, then any account that shared it.
• Make each new password strong and unique to that account⁸.
• Consider a password manager, which the NCSC covers in its guidance, so you do not have to remember every password or reuse one⁹.
• If an account has already been hacked, change its password immediately and change the password on any account that used the same one⁴.

Criminals trick people into revealing passwords by creating fake phishing emails or SMS messages that link to scam websites, so a password typed into a link from a text should be treated as exposed¹⁰.

Contact your bank at once if you gave payment or account details

If you entered banking or card details after clicking a link, or gave them in a reply, contact your bank immediately and tell them what happened¹. Suffolk Fire and Rescue Service gives the same advice plainly: if you have lost money or given a scammer your financial details, contact your bank immediately¹¹. If you use online banking, you can cancel the card or cards online¹.

Contact your bank using the phone number on the back of your card or the official website or app, never the contact details in the message and never a link you were sent¹². The NCSC's recovery guidance is explicit: do not use the links in any messages you have been sent when contacting your bank for support⁵.

If money has already gone, tell your bank straight away and report it as a crime to Report Fraud, the UK's reporting centre for cyber crime. In Scotland, contact Police Scotland instead¹. The same split applies across the official guidance: Report Fraud for England, Wales and Northern Ireland, and Police Scotland for Scotland¹.

If you handed your card to a courier, call your bank straight away to cancel the card¹⁵. For more on what to do when money has gone, see Lost Money to a Scam: Who to Contact and What to Do.

Report the scam text by forwarding it to 7726

Forwarding a scam text to 7726 is free and takes seconds. The message is reported to your mobile phone provider, which can act against the sender³. The NCSC says reporting reduces the amount of scam texts you receive, makes you a harder target for scammers and protects others from cyber crime online². As of September 2026, the 7726 service had removed 41.9 thousand scams across 93.3 thousand URLs².

To report:

1. Do not click any links in the message¹⁶.
2. Forward the text to 7726³.
3. Delete the message afterwards.

Forward scam text messages to 7726, free of charge, and forward suspicious emails to report@phishing.gov.uk¹⁰. The National Cyber Security Centre also asks people to report scam websites alongside texts and emails¹.

One exception worth knowing: if you receive a genuine Emergency Alert on your phone, you will not be able to forward it to 7726, and you should not try to¹⁶. Emergency Alerts are the official government messages sent to phones in a local or national emergency, and they are not scams.

For a step-by-step walkthrough, see How to Report a Scam Text Message.

Watch for follow-up scams after replying

A reply, even a one-word one, can mark your number as live, and scammers may come back with calls or further messages. If a message or call makes you suspicious, stop, break the contact, and consider the language it uses. Tell-tale signs are authority, urgency, emotion, scarcity and current events¹⁷. BT's own guidance lists the same red flag: the text sounds urgent or threatening¹⁸.

If you get an unplanned phone call from a company, even one you use regularly, it could be a scam. Hang up, wait five minutes, and call the company back using a trusted number¹⁹. Legitimate IT companies never cold-call about viruses, so never respond to a call from someone claiming your computer is infected; hang up and report it to Report Fraud²⁰.

After a data breach, scammers often send official-sounding emails about resetting passwords, receiving compensation or confirming identity, full of technical language and urging you to act immediately²¹. These messages typically contain links to websites that look genuine but store your real details once typed in, install viruses, or steal passwords you enter²². Do not click them²³.

Where to get help and report fraud

There are several routes, and which one you use depends on what happened.

Report Fraud deals with all fraud unless the suspect is known to the victim or the victim is vulnerable, in which case call 101²⁴. Age UK's guidance for older people points to the same service: if it is fraud or a scam, contact Report Fraud²⁰. Belfast City Council advises being aware of the warning signs and always reporting if you have been scammed or think someone is attempting to scam you or someone you know²⁵.

If you are helping a family member, the same steps apply: change reused passwords starting with email, turn on two-step verification, and tell their contacts if an account was hacked so they treat recent messages with suspicion⁵. For a wider view of the help available, see The National Cyber Security Centre: Help for Individuals and Families and Phishing: How to Spot a Scam Email, Text or Call.

Protecting the accounts that matter most

Once the immediate risk is dealt with, the priority is to stop it happening again. The NCSC says the first and most important step is to turn on two-step verification (2SV), also called two-factor authentication or 2FA, to help protect you if your password gets phished or otherwise compromised⁹. It usually works by sending a PIN or code, often by SMS or email, to prove it is really you⁵. Even if a criminal knows your password, they will not be able to access your account without that code¹⁰.

Two-step verification is recommended to help protect your online accounts¹⁷. Turn it on first for your email, then your bank and any account that holds payment details. For help, see How to Turn On 2-Step Verification and Which Accounts to Protect With 2-Step Verification.

A strong, separate password for your email matters just as much, because criminals can use email access to reach many of your personal accounts and leave you vulnerable to identity theft¹⁷. If you are unsure whether a password has been exposed, the NCSC's data breach guidance explains what a breach is and what to do after one²². For a practical check, see How to Check If Your Email Was in a Breach.