UK Scam Alerts — September 2026

1. "Your number stops working in 24 hours"

The caller says there's a problem with your account and your number will stop working within 24 hours, or that your SIM is about to be blocked. Sometimes it's a billing issue. Sometimes it's a security check that's failed. Either way the fix is the same: confirm some details, or pay a small activation fee to keep the line running.

The deadline is the whole trick. Nobody thinks clearly with a clock ticking, and a mobile number going dead is a genuinely frightening prospect if it's attached to your bank's two-factor login, your work, your family. So people answer the questions. Full name, address, date of birth, account password, card number for the fee. All of it handed over inside five minutes to someone who rang you out of the blue.

Three will not phone you with a 24-hour deadline. Networks don't operate that way. If there's a real problem with your account you'll hear about it by text or in the app, and you'll have time.

If you get a call like this, hang up. Then ring Three yourself using the number on their website or the back of your SIM packaging. Use a different phone if you can, or wait a couple of minutes before dialling. And never read out account details or passwords to anyone who has called you.

Reported by Which? on 28 August 2026.

2. The one-time passcode account takeover

The scammer already holds part of your O2 account details, probably scraped from an old data breach. They use those details to trigger a genuine one-time passcode, which arrives on your phone from O2's real number, in the same thread as every other legitimate message you've had from them.

Then they ring you. They're from O2 customer service, they're calling about a request on your account, and they need to verify your identity. Can you read back the code that was just sent to you?

The code is real. The message is real. That's why it works.

Once they have it, they own the account. Password changed, calls redirected, international roaming switched on, and you're locked out of the thing that half your other logins depend on. Sorting out a hijacked mobile account takes days.

A passcode sent to your phone is for you to type in, never to say out loud. No legitimate company will ask you to read one back over the phone. Not O2, not your bank, not Amazon, not anybody. If someone asks, that alone tells you exactly who they are. Hang up, and if the code arrived without you asking for it, ring O2 on a number you've looked up yourself and tell them.

Reported by Which? on 20 August 2026.

3. Spyware hiding behind 65 familiar brand names

It starts with a text. A deal, a refund, a delivery, a job offer. More than 65 brands are being impersonated in the campaign, among them Ryanair, Amazon and various government services, so whatever the message says it will look like something you might plausibly be expecting.

The link goes to a convincing enough site that then asks you to install an app. Not from Google Play or the App Store, but directly from the page. And once that app is on the phone it can watch your screen in real time and remotely switch on the microphone and the camera.

Read that again, because it's worse than it sounds at first. Real-time screen access means they see your banking app while you use it, your passwords as you type them, your messages as they arrive. The microphone and camera mean they can listen to and watch whatever is happening around the phone. There's no part of the device left private.

Never install an app from a link in a text message. Genuine apps live on Google Play and the Apple App Store, and nowhere else. If a website is telling you to sideload something, or your phone throws up a warning about installing from unknown sources, that warning is the whole story. Stop there.

If you've already tapped a link and installed something, don't just delete the icon and hope. Apps like this are built to run invisibly and some of them are awkward to remove properly. The phone needs checking, passwords need changing from a different device, and your bank needs telling.

Reported by Which? on 19 August 2026, with an accompanying advisory from the NCSC.