Santander Email Scam UK: How to Spot & Report Fake Banking Emails
Santander won't email you asking for your password, PIN, or card details—but scammers will.
What is this scam?
Santander email scams are phishing attacks where fraudsters send emails pretending to be Santander bank. The emails claim your account has been locked, compromised, or needs urgent verification—creating fake urgency to make you act without thinking. The scammers want you to click a link, which takes you to a fake website designed to look exactly like the real Santander login page. Once there, you're asked to enter your username, password, card details, or security codes. Some versions ask you to 'confirm' transactions you didn't make, or claim suspicious activity requires immediate action. Santander customers are targeted because the bank has millions of UK accounts, and scammers know many people will recognize the brand name and trust it. The emails often use official-looking logos, colours, and language copied directly from genuine Santander communications—making them difficult to spot at a glance.
Warning signs to look for
['- The email asks you to click a link to log in, reset your password, or verify account details—genuine Santander never does this.', "- The sender's email address doesn't match @santander.co.uk (check the full address, not just the display name).", "- The email creates false urgency: 'Your account will be closed in 24 hours' or 'Confirm now to avoid blocking.'", '- Spelling, grammar, or formatting looks off—legitimate bank emails are professionally written and checked.', "- The link doesn't go to santander.co.uk when you hover over it (on desktop, right-click links to see the real URL).", "- You're asked for sensitive information by email—real Santander won't ask for passwords, PINs, full card numbers, or security codes this way.", "- The email address you to 'Dear Customer' or 'Dear User' instead of using your actual name (though some scammers do use names from data breaches).", '- The email mentions unusual activity, fraud alerts, or payment confirmations for transactions you never made.']
How this scam works step by step
Step 1: You receive an email that appears to be from Santander, often triggered by a supposed security issue or account problem. The email includes a logo and branding that looks official, which builds trust. Step 2: The email includes a link marked 'Verify Account', 'Confirm Identity', 'Update Security Details', or similar. The link actually goes to a fake website controlled by the scammers, not Santander's real site. Step 3: When you click the link, you land on a website that mimics the genuine Santander login page so closely that most people wouldn't notice the difference. You're asked to enter your username and password. Step 4: Once you submit your details, the scammers capture them and log into your real Santander account. Step 5: They either transfer your money out directly, set up new payees, or take screenshots of your account to use for identity theft or fraud elsewhere. Some scammers also use captured credentials to set up online shopping accounts or credit applications in your name. The entire process can happen within minutes of you clicking the link.
How to verify if it is genuine
Never click links in banking emails—go directly to Santander's website instead. Open your web browser, type santander.co.uk in the address bar yourself, and log in through that official site. You can also contact Santander directly using the number on the back of your card or your statement, not a number from the email. Check the sender's full email address by clicking the sender's name—real Santander emails come from addresses ending in @santander.co.uk. Hover your mouse over any link in the email (don't click) to see the real URL it points to—scam links usually go to completely different websites or misspelled versions of santander.co.uk. Log into your actual Santander account directly and check whether the issue mentioned in the email appears there. If your account is fine and you see no alerts, the email was almost certainly a scam. You can also check our guide on /guides/is-this-website-a-scam/ to verify any website you're unsure about.
What to do if you have already interacted
If you clicked the link but didn't enter any details, you're likely safe—stop there and don't go back to that email. If you entered your username and password, contact Santander immediately on 0800 9 123 123 (their genuine customer service number from their website) and tell them your login credentials may be compromised. Change your Santander password straight away using the official santander.co.uk website or app. If you entered your full card details, card PIN, or security codes, contact Santander urgently and ask them to cancel your card and issue a new one. If you sent money or authorized a payment through the fake site, contact your bank immediately and report it as fraud—they may be able to stop or reverse the transaction if you act within hours. Check your Santander account daily for the next 30 days for unauthorized transactions. Report the scam email to Action Fraud (see below) and to the NCSC. Monitor your credit file using Clearscore or Experian's free checker to spot any fraudulent accounts opened in your name.
Reporting this scam in the UK
Report the email to the National Cyber Security Centre (NCSC) by forwarding it to report@phishing.gov.uk—include the full email headers if possible. Report the scam to Action Fraud online at actionfraud.police.uk or by calling 0300 123 2040. Your report helps law enforcement track patterns and shut down scam websites. Forward the email to Santander's security team directly by emailing it to their fraud team (you can find this address on your bank statement or by calling 0800 9 123 123). Report the suspicious email to Citizens Advice if you've suffered financial loss—call their consumer helpline on 0808 223 1133 for guidance on next steps. If the scam used SMS or WhatsApp instead of email, forward SMS scams to 7726 (spells SPAM). Keep copies of all emails, screenshots, and records of any money you've lost—these support your official reports and any future compensation claims.
Frequently asked questions
Is Santander a legitimate bank, or should I ignore all emails from them?
Santander is a legitimate, regulated bank in the UK. However, they will never email you asking for passwords, PINs, card details, or security codes. If you receive an email claiming to be from Santander asking for sensitive information, it's always a scam. When in doubt, ignore the email and log into your account directly through the official santander.co.uk website or app instead.
What should I do if I've already sent money to someone through a fake Santander email?
Contact Santander immediately on 0800 9 123 123 and report the transaction as fraud. If the money left your account within the last few hours, there's a small chance they can freeze it before it reaches the scammer's account. Report it to Action Fraud on 0300 123 2040 and provide them with all transaction details. Your bank may be able to recover some or all of the money under their fraud protection scheme, but this depends on how quickly you report it and the circumstances.
Can I get my money back if I've already been scammed through a fake Santander email?
It depends on timing and how much you cooperated with the scam. If you authorized the payment yourself (even to what you thought was a legitimate Santander verification), you may have limited protection under your bank's terms. However, if the scammers gained unauthorized access to your account, Santander's fraud protection should cover your losses. Report it immediately to your bank and to Action Fraud—the sooner you report, the better your chances of recovery. Some money can take weeks or months to recover, but don't give up.
How do I report a fake Santander email I received?
Forward the email to the NCSC at report@phishing.gov.uk. Report the scam to Action Fraud online at actionfraud.police.uk or call 0300 123 2040. Also email it to Santander's fraud team (call their customer service on 0800 9 123 123 to get the correct address). These reports help authorities track scam networks and take down fake websites faster.