NS&I Scam Emails: How Fake Premium Bonds Alerts Steal Your Savings Now
Written by: Lapain Epuran
Published on:
An email says your Premium Bonds have produced wonderful news, or that an urgent security update is waiting in your NS&I account. For a moment, it feels both official and personal.
That small pause is exactly what the sender wants. Before you click, there are several details worth checking.
Overview
NS&I scam emails imitate messages savers expect to receive
NS&I scam emails impersonate National Savings and Investments, the UK government-backed savings provider. They may announce a Premium Bonds prize, demand an account update, warn about restricted access, or present a form with an official-looking reference number.
The message can look convincing because it borrows familiar terms such as Premium Bonds, prize checker, NS&I number, secure message, Terms and Conditions, and account verification. A government logo and restrained design can make the email feel safer than ordinary spam.
NS&I is a legitimate organization. The scam comes from criminals who copy its identity, not from the real provider.
The link leads away from the real NS&I account
The button may say “View your prize,” “Update details,” or “Secure your account.” Its real destination can be a lookalike page designed to collect an NS&I number, surname, password, bank information, or identity documents.
Other versions move the conversation to a fake support agent. The victim may be told that a payment, tax, or release fee is necessary before winnings can be transferred.
Common NS&I phishing stories include:
A Premium Bonds prize is waiting to be claimed
Your password or security details have expired
An account has been blocked after suspicious activity
A new privacy notice or customer form must be accepted
Your bank details must be confirmed before a payment
An unrecognized withdrawal requires immediate review
A prize must be reserved before a short deadline
A stolen login can expose savings and identity information
A fake page may collect enough information for account takeover, password-reset attempts, or convincing follow-up calls. If the same password protects email or banking accounts, the damage can spread beyond NS&I.
Bank details and identity documents can support payment fraud or impersonation. A criminal may also call later, quote the information already submitted, and claim to be an NS&I fraud investigator.
According to NS&I’s official email scam guidance, NS&I will not email a direct link to its login page or ask for online banking details by email. That makes an unexpected login button a reason to stop and verify.
The Premium Bonds Prize Story
Premium Bonds give scammers an unusually effective pretext. Many holders know prizes are drawn regularly, so an unexpected notification does not sound impossible.
A fraudulent email may claim that an unclaimed prize will expire or that payment failed because the registered bank account needs confirmation. The amount is often large enough to excite the recipient but not so extraordinary that it immediately sounds absurd.
The message may omit the exact amount and make the victim click to discover it. Curiosity then becomes the first commitment in a longer chain.
A genuine prize does not require a payment to release it. Taxes, courier charges, verification deposits, and insurance fees introduced by an unsolicited sender are classic advance-fee tactics.
Never use the email button to check whether you won. Open the official NS&I website yourself, use the official prize checker, or check through an app you previously installed from a trusted app store.
The Fake Update Form and Security Alert
Another version avoids the excitement of a prize and uses administrative language instead. It may reference an “updated customer form,” a new privacy policy, or a security review that must be completed.
A numbered form such as “NS&I ID2595” can look like internal paperwork. The reference proves nothing; anyone can type an official-looking number into an email.
The linked page often begins with ordinary information, then asks for increasingly sensitive details. Starting with a postcode or surname can make the later request for a password, card, or bank account feel like a normal progression.
Some pages deliberately reject the first password entered. This encourages the victim to try another password, giving criminals multiple credentials that may work on other services.
A fake security alert can also provide a phone number instead of a link. The person answering may ask for one-time passcodes while pretending to cancel a withdrawal. Those codes may actually approve the attacker’s login or payment.
How the Scam Works
Step 1: A convincing NS&I message reaches the inbox
The campaign sends large numbers of emails using copied branding, a display name such as “NS&I Customer Service,” and a subject about prizes, account access, or updated information.
The visible sender name is not proof of origin. Email accounts and domains can be forged or registered to resemble a genuine business.
Step 2: Reward or fear creates a reason to act now
A prize message creates excitement. A security warning creates anxiety. Both emotions reduce the chance that the recipient will calmly inspect the sender and destination.
The deadline may be measured in hours, even though a real financial provider can offer a safer way to resolve an account issue.
Step 3: A button opens a copied login or claim form
The page may closely resemble NS&I, but the address belongs to an unrelated domain. A padlock only means the connection is encrypted; it does not prove who operates the website.
The form asks for an NS&I number, surname, date of birth, postcode, password, or security answers. Every submitted field goes to the attacker.
Step 4: Banking and identity questions appear
After the first page, the victim may be asked to confirm a bank account, payment card, mobile number, passport, or driving licence. The story says these details are required to pay a prize or protect the account.
A legitimate-looking progress bar can keep the victim moving forward without reconsidering why so much information is needed.
Step 5: A one-time code completes the takeover
The scammer attempts a real login, password reset, card payment, or digital wallet enrollment. The victim receives a genuine code and is told to enter it on the fake page.
The code may authorize the criminal’s action rather than verify the supposed NS&I form. Read every code message carefully and never relay it to an unsolicited caller.
Step 6: A fee or transfer may be demanded
The fake prize can develop into an advance-fee scam. The sender invents a tax, administrative charge, refundable deposit, or identity-verification payment.
Once one payment succeeds, new obstacles appear. The criminal already knows the victim believes the story and may continue until the victim stops paying.
Step 7: Follow-up impersonation deepens the loss
A caller posing as NS&I, a bank, the police, or a recovery service may contact the victim. Previously stolen details make this second approach sound informed.
The caller may tell the victim to move savings to a “safe account.” No genuine fraud team needs a customer to transfer money into an account controlled by a stranger.
Company, Address, and Fulfillment Checks
Check the actual sender, not only the display name
NS&I says its legitimate service emails use addresses ending in @nsandi.com, including addresses such as noreply@nsandi.com and outgoing@nsandi.com. A lookalike ending, added word, or unrelated free-mail address is not the same domain.
Even a familiar visible address should not persuade you to use an embedded login link. Open the official service separately.
Use the independently found NS&I website
Type the known address into the browser, use a saved bookmark, or open the official app. Do not search for a “claim number” supplied by the suspicious email, because paid ads and copied pages can also mislead.
If an account warning is genuine, it should be visible through the trusted account channel or verifiable with support reached independently.
Do not trust an address copied into an email footer
Phishing emails frequently copy the real organization’s registered address, copyright line, and regulatory wording. Those details are public and easy to reproduce.
The important question is where the link goes and who controls the conversation, not whether the footer contains a genuine London address.
Confirm how a prize or payment should be delivered
Review the payment instructions inside your genuine NS&I account. Do not replace bank details through a link opened from an unexpected email.
A request for gift cards, cryptocurrency, cash, or a personal bank transfer is incompatible with a genuine Premium Bonds prize process.
Warning Signs in an NS&I Email
One spelling mistake does not prove fraud, and a polished email is not necessarily safe. Look at the whole path the message wants you to follow.
The sender uses a domain that only resembles nsandi.com
A button leads directly to a login or bank-confirmation page
The email threatens immediate loss of access or a prize
You are asked to pay before winnings can be released
The page requests a full password and one-time code together
A caller insists that you remain on the line during a transfer
The reply address differs from the visible sender
The message tells you not to contact your bank or family
Messages sent to a UK registered address may include part of the holder’s postcode, although NS&I notes that Premium Bonds winner emails are an exception. Personalization can be helpful context, but it is not enough to prove legitimacy.
Criminals can obtain names, postcodes, and investment interests from breaches, public records, or earlier phishing attempts. Never treat one correct personal detail as authentication.
How to Verify a Suspicious Message Safely
Do not click, reply, download attachments, or call the number in the message. Take a screenshot and record the sender and subject if you may need evidence.
Open your account independently and check for notices. If you need help, obtain the contact number from the official NS&I site or an authentic document already in your possession.
Hover over a link on a computer, or press and hold it on a phone without opening it, to preview the destination. A long redirect or unfamiliar host is a warning, but a familiar-looking address is still not a reason to enter credentials.
You can forward suspicious NS&I messages to phishing@nsandi.com. UK recipients can also forward phishing emails to report@phishing.gov.uk and suspicious texts to 7726.
Delete the email only after preserving anything needed for a bank, police, employer, or identity-theft report.
What to Do if You Have Fallen Victim to This Scam
Stop communicating and preserve the evidence. Save the email, full sender address, website address, screenshots, phone numbers, payment instructions, and the time each event occurred.
Contact NS&I through an official channel. Explain what information was entered and ask the real provider to secure the account, review activity, and document the impersonation.
Call your bank immediately. If you disclosed bank or card details or sent money, ask about blocks, replacements, transfer recalls, payment disputes, and monitoring. Use the number on your card or statement.
Change exposed passwords from a clean device. Start with email, then NS&I, banking, and any service using the same or similar password. Turn on multifactor authentication and remove unknown sessions or recovery details.
Protect your identity. If a passport, driving licence, National Insurance number, or detailed identity profile was exposed, follow the issuing authority’s guidance and watch credit files for unfamiliar searches or accounts.
Check the device for malware. If you opened an attachment, installed a program, or allowed remote access, disconnect the device from the internet and run a full scan with Malwarebytes. Remove remote-access tools you did not knowingly install.
Block malicious pages and follow-up links. A reputable content blocker such as AdGuard can reduce exposure to known phishing and malicious advertising, but it does not replace careful verification.
Report the fraud. Forward the phishing message to NS&I and the UK reporting service. Report financial loss to Action Fraud or the appropriate police service, and give banks the report reference.
Expect a second approach. Ignore anyone promising recovery for an upfront fee. Genuine investigators do not need one-time codes or a transfer to a “safe account.”
Is Your Device Infected? Run a Free Malware Scan
Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Anti-Malware Free — one of the most trusted malware removal tools available.
The free version detects and removes the most common threats, including:
Adware — the cause of those annoying pop-ups
Browser hijackers — unwanted redirects and changed homepages
Trojans and spyware — hidden programs stealing your data
Potentially unwanted programs (PUPs) — software you never asked for
👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The whole process takes about 5 minutes.
Malwarebytes for WindowsMalwarebytes for MacMalwarebytes for Android
Run a Malware Scan with Malwarebytes for Windows
Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.
Download Malwarebytes
Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.
(The link opens in a new page where your download will start)
Install Malwarebytes
When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The setup wizard will walk you through a few quick screens:
Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.
Malwarebytes will now install on your device. This usually takes under a minute.
When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.
On the final screen, click Open Malwarebytes to launch the program.
Enable “Scan for Rootkits”
Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.
In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.
Done? Click “Dashboard” in the left pane to return to the main screen.
Start the Scan
Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.
Wait for the Scan to Finish
The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.
Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.
Restart Your Computer
Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.
When the scan finishes, click Quarantine to remove everything Malwarebytes found. That’s it — your Windows PC is now clean of trojans, adware, and other malware, and should be back to running smoothly.
If your current antivirus allowed this malicious program on your computer, you may want to consider purchasing Malwarebytes Premium to protect against these types of threats in the future. If you are still having problems with your computer after completing these instructions, then please follow one of the steps:
Malwarebytes for Mac is a free on-demand scanner that removes the malware other security software tends to miss — adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it’s our go-to recommendation. Follow the steps below to scan and clean your Mac in just a few minutes.
Download Malwarebytes for Mac
Click the button below to download the latest version of Malwarebytes for Mac.
When the download finishes, open your Downloads folder and double-click the setup file to begin the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The Malwarebytes for Mac Installer will guide you through a few quick screens. Click “Continue” and keep following the prompts until the installation completes.
When the installation is complete, Malwarebytes opens to the Welcome to Malwarebytes screen. Click “Get started“.
Select “Personal Computer” or “Work Computer”
Malwarebytes will ask what type of computer you’re installing it on. Click either Personal Computer or Work Computer, whichever applies.
Start the Scan
Click the “Scan” button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.
Wait for the Scan to Finish
Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else — just check back occasionally to see the progress.
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found. Click the “Quarantine” button to remove all the threats at once.
Restart Your Mac
Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot — if Malwarebytes asks you to restart, allow it. Once you’re logged back in, your Mac is clean.
Once the scan is done, remove every threat it detected. Your Mac is now free of adware, rogue browser extensions, and other potentially harmful software.
If your current antivirus allowed a malicious program on your computer, you might want to consider purchasing the full-featured version of Malwarebytes Anti-Malware to protect against these types of threats in the future. If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Android
Malwarebytes for Android automatically detects and removes dangerous threats like malware and ransomware so you don’t have to worry about your most-used device being compromised. Aggressive detection of adware and potentially unwanted programs keeps your Android phone or tablet running smooth.
Download Malwarebytes for Android.
You can download Malwarebytes for Android by clicking the link below.
In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.
When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
Follow the on-screen prompts to complete the setup process
When Malwarebytes will open, you will see the Malwarebytes Setup Wizard which will guide you through a series of permissions and other setup options. This is the first of two screens that explain the difference between the Premium and Free versions. Swipe this screen to continue. Tap on “Got it” to proceed to the next step. Malwarebytes for Android will now ask for a set of permissions that are required to scan your device and protect it from malware. Tap on “Give permission” to continue. Tap on “Allow” to permit Malwarebytes to access the files on your phone.
Update database and run a scan with Malwarebytes for Android
You will now be prompted to update the Malwarebytes database and run a full system scan.
Click on “Update database” to update the Malwarebytes for Android definitions to the latest version, then click on “Run full scan” to perform a system scan.
Wait for the Malwarebytes scan to complete.
Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
Click on “Remove Selected”.
When the scan has been completed, you will be presented with a screen showing the malware infections that Malwarebytes for Android has detected. To remove the malicious apps that Malwarebytes has found, tap on the “Remove Selected” button.
Restart your phone.
Malwarebytes for Android will now remove all the malicious apps that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your device.
After the scan, tap Remove Selected to delete all detected threats. Your Android phone is now clean — no more malicious apps, adware, or browser redirects.
If your current antivirus allowed a malicious app on your phone, you may want to consider purchasing the full-featured version of Malwarebytes to protect against these types of threats in the future. If you are still having problems with your phone after completing these instructions, then please follow one of the steps:
Restore your phone to factory settings by going to Settings > General management > Reset > Factory data reset.
Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.
We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.
No. NS&I can send genuine communications about Premium Bonds. Verify a prize through the official prize checker, your independently opened account, or official support, never through an unexpected email link.
Will NS&I email a link to log in?
NS&I’s published guidance says it will not email a direct link to the login page. Open the official website or app yourself if a message says account action is required.
Does an @nsandi.com sender prove the email is safe?
It is a useful check, but visible sender details can sometimes be forged or compromised. The safest response is still to avoid the embedded link and verify through a channel you opened independently.
Do I have to pay tax or a fee to receive a Premium Bonds prize?
A demand for an upfront release, insurance, courier, or verification payment is a scam sign. Do not send money based on instructions from an unsolicited email or caller.
What if I entered my password but did not send money?
Treat the password as stolen. Change it immediately wherever it was reused, secure your email account, enable multifactor authentication, and contact NS&I through its official website.
Can a padlock prove the NS&I page is genuine?
No. The padlock shows that traffic to the page is encrypted. Criminal phishing sites can also use HTTPS, so the exact domain and independently verified route still matter.
The Bottom Line
NS&I scam emails succeed by attaching urgency to something many savers already recognize: a prize, an account notice, or a routine update. The design may be polished, but the dangerous step is always the same: it pushes you into a channel controlled by the sender.
Do not claim a prize, log in, or change bank details through an unexpected message. Open NS&I independently, verify the notice there, and contact your bank quickly if information or money has already been exposed.
10 Rules to Avoid Online Scams
Here are 10 practical safety rules to help you avoid malware, online shopping scams, crypto scams, and other online fraud. Each tip includes a quick “if you already got hit” action.
Stop and verify before you click, log in, download, or pay.
Most scams win by creating urgency. Verify using a trusted method: type the website address yourself, use the official app, or call a known number (not the one in the message).
If you already clicked: close the page, do not enter passwords, and run a malware scan.
Keep your operating system, browser, and apps updated.
Updates patch security holes used by malware and malicious ads. Turn on automatic updates where possible.
If you saw a scary “update now” pop-up: close it and update only through your device settings or the official app store.
Use layered protection: antivirus plus an ad blocker.
Antivirus helps block malware. An ad blocker reduces scam redirects, phishing pages, and malvertising.
If your browser is acting weird: remove unknown extensions, reset the browser, then run a full scan.
Install apps, software, and extensions only from official sources.
Avoid cracked software, “keygens,” and random downloads. During installs, choose Custom/Advanced and decline bundled offers you do not recognize.
If you already installed something suspicious: uninstall it, restart, and scan again.
Treat links and attachments as untrusted by default.
Phishing often impersonates delivery services, banks, and popular brands. If it is unexpected, do not open attachments or log in through the message.
If you entered credentials: change the password immediately and enable 2FA.
Shop safely: research the store, then pay with protection.
Be cautious with brand-new stores, “closing sale” stories, and prices that make no sense. Prefer credit cards or PayPal for dispute options. Avoid wire transfers, gift cards, and crypto payments.
If you already paid: contact your card issuer or PayPal quickly to dispute the transaction.
Crypto rule: never pay a “fee” to withdraw or recover money.
Common patterns include fake profits, then “tax,” “gas,” or “verification” fees. Another is a “recovery agent” who demands upfront crypto.
If you already sent crypto: stop paying, save evidence (wallet addresses, TXIDs, chats), and report the scam to the platform used.
Secure your accounts with unique passwords and 2FA (start with email).
Use a password manager and unique passwords for every account. Enable 2FA using an authenticator app when possible.
If you suspect an account takeover: change passwords, sign out of all devices, and review recent logins and recovery settings.
Back up important files and keep one backup offline.
Backups protect you from ransomware and device failure. Keep at least one backup on an external drive that is not always connected.
If you suspect infection: do not connect backup drives until the system is clean.
If you think you are a victim: stop losses, document evidence, and escalate fast.
Move quickly. Speed matters for disputes, account recovery, and limiting damage.
Stop payments and contact: do not send more money or respond to the scammer.
Call your bank or card issuer: block transactions, replace the card if needed, and start a dispute or chargeback.
Secure your email first: change the email password, enable 2FA, and remove unfamiliar recovery options.
Secure other accounts: change passwords, enable 2FA, and log out of all sessions.
Scan your device: remove suspicious apps or extensions, then run a full malware scan.
Save evidence: screenshots, emails, order pages, tracking pages, wallet addresses, TXIDs, and chat logs.
Report it: to the payment provider, marketplace, social platform, exchange, or wallet service involved.
These rules are intentionally simple. Most online losses happen when decisions are rushed. Slow down, verify independently, and use payment methods and account controls that give you recourse.
Hello! I'm Lapain Epuran, your go-to source for detailed and honest product reviews. From tech gadgets to miracle cures, I provide insights to help you make informed choices. Join me as we discover what's truly worth your time and money.
