How to spot and avoid online scams if you're over 55

Scams cost UK adults an estimated £2.3 billion in 2023, according to UK Finance. Most of that money was lost not because people were careless, but because the scams were genuinely convincing. A realistic-looking email, a phone call from someone who already knew your name and postcode, a website indistinguishable from a real one. The good news is that a handful of reliable habits can stop the vast majority of attacks before any damage is done.

This guide explains what to look for, what to do when something feels wrong and how to report it if the worst happens.

---

Why scammers specifically target people in later life

It isn't ageism to acknowledge this: financial criminals go where the money is. People aged 55 and over in the UK collectively hold a significant share of the country's wealth, and they're more likely to own property, have savings and receive pension income. That makes them a priority for fraudsters running investment scams, pension fraud and inheritance cons.

There's also a generational familiarity gap with certain digital warning signs. Younger people grew up with email and social media at an age when scams were already common. Many older adults came to these technologies later, without the informal apprenticeship in spotting fakes that comes from years of exposure. That's not a failing. It just means the tell-tale signs are worth learning deliberately, rather than absorbing by accident.

---

What are the most common scams in the UK right now?

Phishing emails and fake texts (smishing). You receive a message that appears to be from your bank, HMRC, Royal Mail or the NHS. It tells you to click a link and log in, verify your details or pay a small delivery fee. The link goes to a fake website designed to steal your login credentials or card details. HMRC and Royal Mail are currently two of the most impersonated organisations in the UK, according to the National Cyber Security Centre (NCSC).

Phone scams (vishing). A caller claims to be from your bank's fraud team, the police or BT. They may already know your name, address and partial account details, bought from data breaches or previous leaks. They'll tell you your account is at risk and ask you to move your money "somewhere safe" or give them a one-time passcode. Banks and the police will never ask you to do either.

Fake investment opportunities. These range from cryptocurrency platforms promising guaranteed returns to "bond" schemes and overseas property investments. They often arrive via social media, sometimes using the face of a well-known public figure. The FCA's warning list (fca.org.uk/scamsmart) is worth bookmarking.

Romance scams. Someone makes contact, often through a dating site or Facebook, builds a relationship over weeks or months, and eventually asks for money. Action Fraud received over 8,000 reports of romance fraud in 2023. The sums lost were often significant, precisely because the emotional relationship felt real.

Computer "fix-it" scams. A pop-up appears on your screen warning of a virus. A number appears. You call it, a person answers, and they ask you to download software so they can "fix" the problem remotely. Once you grant them access, they can see your files, banking apps and saved passwords.

---

How to tell if something is a scam

No single rule catches everything, but the following patterns should make you pause.

Unexpected contact. You weren't expecting the email, text or call. That doesn't mean it's automatically fraudulent, but it's reason enough to be cautious before doing anything.

Urgency. Scammers create pressure because pressure stops people thinking clearly. "Your account will be suspended in 24 hours." "You must act now or lose the money." Real organisations, including banks, HMRC and the NHS, allow time for you to verify things independently.

Requests for payment by unusual methods. Gift cards (iTunes, Amazon), bank transfers to unfamiliar accounts, or cryptocurrency. These payment methods are favoured by scammers precisely because they're difficult or impossible to reverse.

Something just feels off. Trust that instinct. In my experience, people who've been scammed often say afterwards that something felt strange early on, but they pushed the feeling aside. You don't need to be able to name the problem. Feeling uncertain is enough reason to stop and check.

---

Five practical habits that make a real difference

Pause before you click. If an email or text contains a link, don't click it immediately. Instead, go to the organisation's website directly by typing the address into your browser yourself. The NCSC's website (ncsc.gov.uk) has a free email checking tool if you're unsure.

Use two-factor authentication. This is an extra security step, usually a code sent to your phone, that's required when you log in to email, banking or shopping accounts. Even if someone steals your password, they can't get in without the code. Most major services offer it, including Gmail, Outlook, Amazon and all UK high street banks.

Keep software up to date. Updates are boring, but they close security holes that scammers exploit. Enable automatic updates on your phone, tablet and computer so you don't have to remember to do it manually.

Check with someone you trust. If you're being pressured into a financial decision and you're not sure, call a family member, a friend, or Citizens Advice (0808 223 1133). A legitimate offer will still be there after you've had a chance to think. A scam will usually evaporate under scrutiny.

Register with the Telephone Preference Service. The TPS (tpsonline.org.uk) is a free opt-out register for unsolicited sales calls. It won't stop all cold calls, particularly from fraudsters operating overseas, but it reduces the volume.

---

---

What to do if you think you've already been scammed

Act quickly. The steps below are in order for a reason.

First, stop all contact with the scammer. Block the number or email address. Don't reply, even to confront them or demand your money back.

Second, call your bank's fraud line. The number is on the back of your debit or credit card. Explain what happened. Under Payment Systems Regulator rules introduced in October 2024, banks must reimburse most victims of authorised push payment fraud up to £85,000. Your chances are much better if you report within the same day.

Third, change your passwords. If you entered any login details on a suspicious website, change that password immediately on the real site. If you use the same password elsewhere (I'd suggest you don't, but many people do), change it there too.

Fourth, report to Action Fraud, as above. Even if you don't get money back, your report contributes to the data that helps police identify organised fraud networks.

Finally, talk to someone. Being scammed can feel humiliating. It really shouldn't. These are sophisticated operations run by organised criminals. Age UK (0800 678 1602) has staff trained to support people who've experienced fraud, not just financially but emotionally too.

---

How to help an older relative stay safe online

If you're reading this on behalf of a parent or relative, a few targeted changes are more effective than a long lecture about security.

Set up two-factor authentication on their email account for them. Help them identify the number on the back of their bank card so they know where to call in an emergency. Show them how to forward a suspicious text to 7726.

The charity Get Safe Online (getsafeonline.org) has resources written specifically for older adults and their families, including a phone helpline. It's a good first stop if you're not sure where to begin.

For more on how to make technology simpler and safer for people over 55, see our simple technology guides hub.

---