NatWest Phishing Emails: Spot a Fake NatWest Email (UK)

Scammers are sending fake NatWest emails that look almost identical to real bank messages — here's how to tell them apart.

By Alex Bacsa · Published 2026-04-27 · Updated 2026-07-26 · 5 min read

What a fake NatWest email looks like

A NatWest phishing email imitates the bank so you click a link and give away login details, card details, passwords, one-time codes, or personal information. An example of the style is an email from a display name such as NatWest with a subject like Unusual activity detected on your account, followed by a button saying Restore access.

The pretext changes - a blocked payment, a new device, a locked account, or a security check - but the goal is to rush you onto a fake NatWest sign-in page. The link may point to a lookalike such as natwest-secure-verify.example. Check through the NatWest app or website yourself, not through the email.

Why these NatWest emails fool people

Phishing emails can copy NatWest branding, and the visible sender name can be set to almost anything. Link text can look like a real NatWest address while leading somewhere else. A message can also come from a compromised mailbox, so checking only the sender display name is not enough.

NatWest says scam emails often impersonate trusted organisations and advises customers to avoid clicking links, QR codes, and attachments from unknown sources. It also says it will never ask for your full PIN, full password or card-reader codes by text, email or phone — wording that is deliberately scoped, because partial security checks can happen when you are the one who made contact. NatWest also says it will include some personal details in its emails, such as part of your name and postcode.

That makes a generic urgent email more suspicious, but the safest check is still to go to NatWest independently.

Signs a NatWest email is phishing

• A generic greeting such as Dear Customer, especially with urgent pressure.
• The sender address is not clearly NatWest-owned, or a link points to an unfamiliar domain.
• It pushes you to verify, restore, secure, or unlock your account through a button.
• It asks for your full password, full PIN, card-reader codes, full card details, a one-time passcode, or bank account details.
• It tells you to move money to a new or "safe" account.
• It includes an unexpected attachment or QR code.
• Spelling and layout errors can help, but polished emails can still be scams.

How the NatWest email scam works

First, an email lands that looks like a NatWest security alert. Second, it pushes you to click a link or open an attachment. Third, the link opens a copycat login page or form. Fourth, anything you type is captured by criminals. Fifth, the fake page may ask for a one-time passcode so the criminals can approve a login or payment in real time.

Checking through the NatWest app, by typing the address yourself, or by calling the number on your card stops the scam before you hand over details.

How to check if a NatWest email is genuine

Do not click links or open attachments in a suspicious email. Instead:

• Open the NatWest app and check messages and account activity there.
• Type natwest.com yourself, or use a trusted bookmark.
• Call the number on the back of your card.
• Use 159 if you need a safe route back to your bank. Stop Scams UK lists NatWest as a 159 participant.
• If the email cannot be confirmed independently, treat it as suspicious.

Our guide on Is This Website a Scam? A Practical Checklist Before You Buy helps you check a suspicious linked site, and our NatWest Scam Texts: How to Spot a Fake NatWest SMS (UK) guide covers the same scam by text.

If you clicked or shared details

Act quickly. If you entered login details, card details, or a one-time code, contact NatWest immediately using the app, 159, or the number on your card. Tell them you may have been phished and ask them to secure the account. Change your NatWest password only through the official app or website, and anywhere else you reused it. Run a security scan if you opened an attachment.

Our scam recovery checklist sets out what comes next: stopping and replacing the card, reviewing payments and new payees, protecting identity details, and the money-recovery routes.

How to report a fake NatWest email (UK)

Forward the suspicious email to the NCSC at report@phishing.gov.uk. NCSC says it can analyse reported emails and the websites they link to, and work to remove malicious links where found.

Report suspicious NatWest emails to phishing@natwest.com, as NatWest advises. If the same scam reached you by text, forward the text to 7726.

If you lost money, shared sensitive information, or were hacked, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 if you are in England, Wales, or Northern Ireland. In Scotland, report to Police Scotland on 101.

Frequently asked questions

Sources checked

• NatWest — Email fraud
• NatWest — Report fraud
• NatWest — I have received a suspicious email, what do I do?

Reporting routes in this guide are checked against our verified canon of official UK sources — Report Fraud for England, Wales and Northern Ireland, or Police Scotland on 101 for Scotland, the National Cyber Security Centre, and the consumer service for each nation — by an automated accuracy gate before publication. Editorially updated by Alex Bacsa, Founder & Editor, on 2026-07-26. Read about how Beat the Scam writes guides.