⚖️ Anti-Phishing Laws UK — What's Illegal and How to Report

Sunday, 02 August 2026

Phishing is a crime in the UK — but not under a single "Anti-Phishing Act". Instead, several laws cover it, and the penalties are serious. This guide explains the legal position, what phishing actually breaks, and how to report it.

Is phishing illegal in the UK?

Yes. Phishing is prosecuted under multiple UK laws, and convictions carry prison sentences of up to 10+ years depending on the offence.

There is no single UK "Anti-Phishing Act" — the behaviour falls under existing legislation:

Law What it covers Max penalty
Fraud Act 2006 Fraud by false representation — the core phishing offence Up to 10 years
Computer Misuse Act 1990 Unauthorised access to computers — using stolen credentials, hacking Up to 10 years (s.3A)
Data Protection Act 2018 Handling stolen personal data Unlimited fines
Money Laundering Regulations Moving money from phishing victims Varies
Online Safety Act 2023 Platforms must remove scam content Regulatory fines

The US has an Anti-Phishing Act — in the UK, the Fraud Act 2006 s.2 (fraud by false representation) is the main phishing offence.

How phishing breaks the law

A typical phishing attack commits several offences:

  1. Fraud by false representation (Fraud Act 2006) — pretending to be your bank to get your details
  2. Possessing/using articles for fraud (s.6–7) — running the fake website or email system
  3. Unauthorised access (Computer Misuse Act 1990) — logging into accounts with stolen credentials
  4. Possession of criminal property (POCA 2002) — the money you're tricked into sending

Penalties for phishing

  • Fraud Act offences: up to 10 years in prison
  • Computer misuse offences: up to 10 years
  • Money laundering: up to 14 years
  • Sentences in practice: most phishing fraudsters get 1–7 years, but organised gangs and repeat offenders get the top end

Can you report phishing?

Yes — always. Even if you didn't lose money, report it:

  • Action Fraud — 0300 123 2040 or actionfraud.police.uk
  • Your bank — report scam texts/emails pretending to be them
  • NCSC (National Cyber Security Centre) — forward suspicious emails to [email protected]
  • Suspicious texts — forward to 7726 (free)
  • Suspicious calls — report to Action Fraud

✅ Report every phishing attempt. Each report feeds the National Fraud Intelligence Bureau and helps shut down the campaign.

How to protect yourself

  • Never click links in unexpected emails or texts — go to the site directly
  • Never share one-time codes — banks never ask for them
  • Check the sender address — not just the display name
  • Use 2FA on email and banking
  • Update software — phishing often installs malware via exploits
  • See our full phishing guide and spotting phishing scams

What to do if you've been phished

  1. Change your passwords immediately — email first, then banking
  2. Call your bank's fraud line if money or card details were involved
  3. Report to Action Fraud and get a crime reference number
  4. Check for unauthorised transactions in the last 90 days
  5. Report the email/text to [email protected] or 7726

Related guides

CyberAware UK — helping families report crime, recover from scams, and stay safe online.