TL;DR: Which? warned on October 7, 2026 about a NatWest scam email with accurate branding that asks you to check your account information is up to date via a link. The link leads to a fake login page. NatWest says it won’t ask for personal information by email and will only ever ask for random characters from your PIN or password. Forward suspicious emails to phishing@natwest.com and call 03457 888444 if you responded.
What the email looks like
According to Which?, the October 2026 version uses accurate NatWest branding and asks you to check your account information is up to date through a link. It looks routine, which is the point. “Please confirm your details” is the most boring sentence in banking, and boring is believable.
The link goes to a lookalike page that collects your customer number, PIN and password characters, and sometimes a one-time code.
What NatWest says
From NatWest’s reporting page:
- NatWest won’t ask for personal information by email.
- It would only ever ask for random characters from your PIN or password, never the full thing.
- If you received a suspicious email and haven’t responded, forward it to phishing@natwest.com.
Why this matters: the 2026 numbers
UK Finance’s annual fraud report, covered by The Register in June 2026, put total UK payment fraud losses for 2025 at about £1.28 billion. Unauthorised fraud, where criminals use your stolen card or login, accounted for £703.4 million. Authorised push payment (APP) fraud, where you’re tricked into sending money, rose 19% to over £576 million, with impersonation scams among the types whose case numbers grew.
A phishing email is the front door to both kinds. Your login lets them spend; a follow-up "fraud team" call talks you into moving money yourself.
Spot the fake
- a link to log in or “verify” (log in via the app or by typing natwest.com instead);
- a sender address that isn’t a NatWest domain;
- requests for your full PIN or password;
- urgency: “your account will be restricted within 24 hours.”
The follow-up call
Phishing emails are often step one. A day later, a "NatWest fraud team" may call to say your account was attacked and you need to move money to a "safe account". A genuine bank protecting your account freezes it; it doesn’t ask you to move the money. Hang up and call the number on your card, ideally from another phone (how bank impersonation calls work).
If you clicked and entered details
Call NatWest immediately: personal customers 03457 888444 (overseas +44 3457 888444), business 03457 114477. Or dial 159 (how 159 works). Change your credentials and check recent payments. Report losses to Report Fraud.
Report other phishing too
Forward scam emails to report@phishing.gov.uk (the NCSC’s service) and scam texts to 7726.
Why you got it
NatWest phishing is sent to people who bank everywhere. Lists come from breached emails. A free email exposure check shows which breaches include your address. See also UK bank impersonation scams.
Frequently Asked Questions
How do I report a NatWest phishing email?
Forward it to phishing@natwest.com if you haven’t responded, then delete it.
Does NatWest ask for my PIN or password by email?
No. NatWest says it won’t ask for personal information by email and only ever asks for random characters from your PIN or password.
I entered my details on a fake NatWest page. What now?
Call NatWest on 03457 888444 (personal) or 159 immediately and change your security details.
Where else can I report phishing in the UK?
Forward emails to report@phishing.gov.uk and texts to 7726.
Sources
- NatWest: How to report a phishing or scam email
- Which?: The latest scam alerts (NatWest email, Oct 7, 2026)
- The Register: UK Finance fraud report, Brits lose £1.3B (Jun 2026)