When it comes to scams, knowing when to slow down and when to act quickly can make all the difference.
There is an odd contradiction at the heart of scam prevention.
When somebody is asking you to do something, slow down.
But if you realise you have already been tricked, move quickly.
Getting those two things the right way round can prevent a scam succeeding or help limit the damage if it already has.
Scammers want to control the clock
We still tend to imagine scams as badly written emails full of spelling mistakes and suspicious links.
Some still look like that – many now don’t.
A fraudulent banking website can look almost identical to the real thing. A caller can appear to be ringing from a genuine telephone number. A message from your “son” or “daughter” can arrive with enough personal information to sound convincing.
AI is making some of this deception easier too.
That means looking for obvious mistakes is becoming a less reliable defence.
One of the warning signs I pay much more attention to is pressure.
The scammer wants to control the pace of the conversation.
Your account is about to be closed.
Your parcel cannot be delivered unless you pay now.
There has been suspicious activity on your bank account.
Your son has lost his phone and urgently needs some money.
Your boss needs those gift cards before the meeting starts.
A supplier has changed their bank details and the invoice is due today.
Different scams. Same technique.
They are trying to move you from thinking to reacting.
Official UK fraud guidance makes the same point: don’t allow yourself to be rushed, and if you are suspicious, stop the conversation and verify the request independently. Caller ID should not be treated as proof of who is contacting you either.
Before acting: slow down
This is the part where being deliberately awkward can protect you.
If somebody tells you that you must act immediately, give yourself more time, not less.
Hang up.
Close the message.
Don’t click the link.
Don’t scan the QR code yet.
Don’t approve the payment.
Then ask a very simple question:
How do I know this person is really who they say they are?
Don’t answer that question using information they have supplied.
If your bank apparently calls you, use the banking app, the number on your card or another known contact route. UK consumers can also call 159 to reach participating banks securely.
If somebody claiming to be a family member contacts you from a new number asking for money, contact them using the number you already have.
If an email says you owe HMRC money, go to GOV.UK yourself rather than following the link.
If a QR code on a parking machine asks for payment, check whether the car park operator has an official app or website first.
A QR code isn’t proof of anything. It is just a shortcut to a web address.
If an email from a supplier says their bank details have changed, pick up the phone and verify them using a number you already know.
That last example is particularly important for businesses. A scam that starts with an email can very quickly become a five-figure bank transfer.
The more somebody rushes you, the more time you should take
That is probably the single piece of advice I would like people to remember.
The more somebody is trying to rush you, the more time you should give yourself to check.
A genuine bank won’t object because you want to verify a call.
A genuine supplier won’t be offended because you want to confirm their new bank details.
A genuine colleague won’t mind you checking an unusual request.
Security doesn’t always need another piece of software.
Sometimes it is simply about introducing a little friction before something important happens.
But what if you’ve already acted?
This is where the rule changes.
Perhaps you clicked the link.
Perhaps you entered your password.
Perhaps you gave somebody a security code.
Perhaps you installed software they told you was needed to “fix” your computer.
Or perhaps the payment has already left your bank account.
Now is not the time to wait and see what happens.
After acting: move quickly.
If money has been sent, contact your bank immediately using a trusted number. Government-backed Stop! Think Fraud guidance says acting quickly may give the bank a better opportunity to stop or recover a fraudulent payment.
If you disclosed a password, change it immediately. If you have reused that password anywhere else, change it there too. Turn on multi-factor authentication where available and check account recovery information.
Email deserves particular attention because access to your inbox can give a criminal a route into many of your other accounts through password resets.
If you allowed somebody remote access to your computer, disconnect the device from the internet and get appropriate technical help. Don’t simply uninstall the program and assume everything is fine.
And if the incident happened at work, tell whoever is responsible for IT or cyber security as soon as possible.
A quick admission that “I think I’ve clicked something” is far easier to deal with than discovering the same incident several days later.
Don’t let embarrassment give the scammer more time
People sometimes stay quiet after falling for a scam because they feel embarrassed.
That hesitation helps the criminal.
These scams are deliberately designed to manipulate normal human behaviour. They exploit trust, authority, fear, curiosity, helpfulness and urgency.
The question isn’t whether somebody was “clever enough” to spot it.
The useful question is:
What do we do now?
If somebody tells you quickly, there may still be time to reset credentials, revoke sessions, stop payments, block accounts or investigate what happened.
That is why organisations should make it easy for staff to report mistakes as well.
Someone saying “I’ve done something and I’m worried it might have been a scam” should trigger help, not a telling-off.
Report it too
There are several useful reporting routes in the UK.
Suspicious emails can be forwarded to the National Cyber Security Centre at report@phishing.gov.uk, and suspicious texts can normally be forwarded to 7726. The NCSC says its reporting service has received more than 58 million scam reports, helping it remove hundreds of thousands of malicious URLs.
If you have actually lost money or been the victim of cyber crime or fraud in England, Wales or Northern Ireland, the national service is now Report Fraud, which replaced Action Fraud in 2026. In Scotland, incidents should be reported to Police Scotland.
So the practical sequence is:
- Before you pay, click, share or approve: slow down.
- Verify through a different, trusted route.
- If you’ve already acted: move quickly.
- Contact your bank, change compromised credentials and get help.
- Tell somebody and report the scam.
A simple rule worth remembering
We cannot expect people to memorise every scam.
Tomorrow’s scam may look completely different from today’s.
But the psychology behind them changes much more slowly.
Criminals want urgency because urgency leaves less room for doubt.
So give yourself that room.
Before acting: slow down.
And if you realise something has gone wrong:
After acting: move quickly.
That simple distinction might stop a bad moment becoming a very expensive one.
