Fake NatWest email uses accurate branding to direct customers to copycat login page

What is this scam?

Which? flagged a new NatWest phishing email on 7 October 2026 that closely replicates the bank's branding and formatting, telling recipients their account information needs to be reviewed and updated. The embedded link leads to a convincing fake NatWest login page designed to steal banking credentials and personal details. The email is distinct from the earlier NatWest biometric-login scam — it uses a generic account-verification hook rather than regulatory pressure. NatWest never sends unsolicited emails with embedded login links; customers should access their account only directly at natwest.com.

Example scam message

Red flags to look out for

• The message creates urgency — threatening a fine, missed delivery, or account closure.
• Links lead to unofficial domains that don't match the real company's website.
• You weren't expecting this message and can't verify the event it references.
• It asks you to confirm payment details or personal information via a link.
• The sender's number or email address doesn't match the company's official contact.

What to do if you receive this

1. Do not transfer money — your bank will never ask you to move funds to a 'safe account'.
2. Hang up and call your bank directly on the number printed on the back of your card.
3. Report it to Action Fraud at actionfraud.police.uk.
4. If you've already transferred money, contact your bank immediately and ask about the APP fraud refund scheme.