The Text Knows Your Postcode: A Hull Household's One-Hour Scam Lockdown

The message says your parcel is held at a depot near the Marina. Another says there is a council tax rebate waiting, and it uses your postcode. A call claims to be from your bank and reads out the first line of your address. None of this is proof of anything. Scammers buy postcodes, scrape business names and borrow landmarks because local detail makes people relax.

This is not a lecture about being careful. It is a plan. Give it an hour, once, and you will have made your household or shop a much harder target.

Why 'Hull' in a Message Doesn't Make It Real

A scam text can mention HU1, the Old Town, Kingswood, Hessle Road or a real delivery firm and still be rubbish. The local flavour is the costume, not the person. The same applies to calls about council tax, parking fines, energy rebates or unpaid invoices. Real organisations do not usually ask you to settle something by clicking a link in a text or reading out card details to a caller who rang you.

The best defence is a rule, not a feeling. Any message about money, delivery, tax, accounts or fines gets verified through a number or website you already know. Not the number in the message. Not the link in the text.

The Grandparent Test (It Works for Everyone)

Agree a family rule and give it a name, because names stick. The grandparent test is simple: if a message would make your grandparent panic, it is designed to make you panic too. So you stop, read it aloud, and ask whether it makes sense.

A stronger version is a family codeword or a callback rule. If someone claims to be a relative in trouble, or a bank, or a shop supplier, you ring them back on a number you already have. You do not continue the conversation on the number that called you. Write this rule down and stick it on the fridge or the staffroom wall.

0-10 Minutes: Lock the Money Side

Open your banking apps and turn on notifications for every payment, not just large ones. Check the card controls. Most banks let you freeze a card instantly, set spending limits and switch off online payments. Do that now, while you are calm, so you are not learning the app in a panic.

If you have saved card details in shopping apps or browsers, remove the ones you do not need. Save the number 159. It is the UK-wide bank scam hotline, and it connects you to your bank's fraud team. Put it in your contacts under something obvious.

10-20 Minutes: Make Links Guilty Until Proven Innocent

Do not click links in unexpected texts. Long-press a link to preview the full web address if your phone allows it. Look for the real domain before the first slash, not the words after it. A link that says royal-mail-something is not Royal Mail. A link with a Hull postcode in the text is still just a link.

Forward scam texts to 7726. That is the free reporting service used by UK networks. It helps them block numbers. Report the message, then delete it. Do not reply, not even to say stop.

20-30 Minutes: Turn On Call Filtering

On an iPhone, look under Settings, then Phone, then Silence Unknown Callers. On Android, the wording varies, but call screening and spam protection are usually in the Phone app settings. Your network may also offer a call protect service. Switch on what you can live with.

A good household rule is that unknown callers go to voicemail. If it matters, they will leave a message. If it is a scam, they usually will not. For small shops, make sure staff know they are allowed to say 'I will call you back on the number we hold' and end the call.

30-40 Minutes: Passwords, 2FA and the Family Password Manager

Use a different password for your email and your bank. If that sounds obvious, it is also the thing most people skip. Turn on two-factor authentication, and use an authenticator app rather than text messages where you can. Email is the master key to most accounts, so protect it first.

If you run a shop, do the same for the business email and the card machine account. Do not share one login across staff. A password manager is worth the ten minutes it takes to set up.

40-50 Minutes: Agree the Household Script

Write down what happens when a suspicious message arrives. Who do you tell? What number do you call? Where is the card freeze button? For families, agree that nobody gets mocked for checking. The grandparent test only works if people feel able to use it.

For shops, put a short script by the till: no card details over the phone, no bank changes without a callback to a known number, no refunds on a card that is not present. Boring rules stop quick decisions.

50-60 Minutes: The Invoice That Changes Midweek

Small businesses get hit by invoice scams that look like a supplier changing bank details. The email may use the right logo and the right name. The defence is a phone call to a number you already have, not the number in the email. Make dual approval normal for any payment over a set amount. It feels fussy until it saves you.

If Someone Has Already Clicked or Paid: The First 20 Minutes

Call your bank on 159 straight away. Tell them what happened and ask them to freeze the card or account. Do not move more money to 'protect' it. Change the password on your email and any account you entered. Report it to Action Fraud. Forward the text to 7726. Tell the people around you, because shame keeps scams working.

If you clicked a link but did not enter details, change the password anyway and run a security check on the device. If you entered card details, the bank call is urgent. If you paid by bank transfer, speed matters more than anything else on this list.

The Point Isn't Paranoia

The point is to make the scammer's job awkward. A household that checks, calls back and talks about it is a poor target. A shop with a script by the till is a poor target. You do not need to be technical. You need one hour, one rule and the willingness to slow down when a message says hurry.