Where to report a scam, and checks you can use
Had a suspicious email or text, a password you think has leaked, or a payment that looks like fraud? Start here: where to report it, two checks you can run on this site, and independent services that can help.
Except where tagged 'On this site', the services in the four groups below are run by other organisations and aren't connected to Secordit.
Been scammed?
-
Report scam emails and texts
Use this when a message looks like a scam.
Forward scam emails to [email protected] and scam texts to 7726.
Visit the GOV.UK reporting page (opens in a new tab)Think you've been scammed or hacked? Our kit for this: After a Scam: What to Do First
-
Report Fraud (which replaced Action Fraud)
Use this when you've been affected by fraud or cyber crime in England, Wales or Northern Ireland.
In Scotland, call Police Scotland on 101.
Visit Report Fraud (opens in a new tab)Supplier says their bank details changed? Our kit for this: Bank Details Changed?
Check if you're exposed
-
Have I Been Pwned
Use this when you want to see which known data breaches your email address appears in.
Visit Have I Been Pwned (opens in a new tab)My account's been hacked? Our kit for this: Account Lockdown Kit
- On this site
Could someone fake emails from this domain?
Enter a domain, such as your own or a supplier's. See whether it publishes SPF, DKIM and DMARC, the records that help receiving email servers spot fakes.
-
VirusTotal
Use this when you want a second opinion on a suspicious file or link.
VirusTotal says its free service is for non-commercial use. Don't upload anything confidential.
Protect your accounts
- On this site
Has this password appeared in a data breach?
See whether a password is in the Pwned Passwords list of passwords exposed in known data breaches, from Have I Been Pwned.
-
Bitwarden
Use this when you want a password manager, or the one built into your device, to create and store a different password for each account.
Bitwarden's basic plan is free.
For small businesses
-
NCSC Cyber Action Toolkit
Use this when you run a small business and want clear, bite-sized steps to start protecting it.
-
NCSC Check your cyber security
Use this when you want simple online checks of your organisation's website, email and browser for common weaknesses.
Visit NCSC Check your cyber security (opens in a new tab)A customer asked for Cyber Essentials? Our kit for this: Cyber Essentials Questionnaire Prep Kit
Professional testing
Sencode Cyber Security
Penetration testing. Use this when you need a professional test of your systems.
Work out a data protection deadline
A subject access request or a personal data breach starts a clock, and the dates are easy to get wrong. Enter a date to see the deadline, worked out from guidance by the Information Commission (known as the ICO).
Subject access request: when is the reply due?
How it's worked out
- One calendar month, from the day you receive the request to the same date next month.
- If next month has no matching date (say, 31 January), it's the last day of that month.
- If that day is a weekend or a bank holiday, it moves to the next working day. Bank holidays are for England and Wales. If you're in Scotland or Northern Ireland, check your own bank holidays.
- For a complex request, or several requests from the same person, you can extend by up to two more months. Tell the person, and say why, within the first month.
- If you need ID first, the month starts when you receive it. If you ask the person to clarify their request, the clock stops on the day you ask and starts again the day after they reply.
Dealing with a request? Our kit for this: Subject Access Request Response Kit
Personal data breach: when do the 72 hours run out?
How it's worked out
- If a breach is likely to put people's rights and freedoms at risk, you must report it to the ICO without undue delay. Where feasible, do this within 72 hours of becoming aware of it.
- If you report later than that, you must give reasons for the delay.
- You can send the details in stages if you don't have them all yet.
- If the risk to people is high, you must also tell them without undue delay.
- Keep a record of every breach, including ones you don't report.
Just found a breach? Our kit for this: First Hour After a Breach
This works out dates only. It can't tell you whether a request or breach applies to you. Rules from ICO guidance on responding to subject access requests and personal data breaches. Bank holidays from GOV.UK.