What to do if…
you receive an urgent notice demanding identity documents within 48 hours

What to do now

1. Keep the notice exactly as received. Save the email or text, take screenshots, keep attachments, and keep the envelope if it came by post. Note when it arrived and the deadline it claims.

2. Check who the notice claims to be from without using the notice itself.

   • If it claims to be a government body, regulator, police force, court, or council, find the official contact page yourself through GOV.UK or the organisation’s known website.
   • If it claims to be your bank, employer, solicitor, landlord, university, insurer, or service provider, use the number inside your app, on your card, on a previous genuine letter, or on a website you type in yourself.

3. Ask the verified organisation to confirm the request. Use a verified channel and ask:

   • “Is this compliance review notice genuine and logged on my account or case?”
   • “What exact documents do you need?”
   • “Why are these documents needed?”
   • “What secure method should I use to provide them?”
   • “Can the deadline be paused or extended while I verify the request?”

4. If it is an email or text and you are unsure, report it and do not continue through that channel.

   • Forward suspicious emails to [email protected].
   • Forward suspicious texts to 7726. Most UK phone providers support this free reporting route.
   • Do not reply, click links, open attachments, or upload documents through the suspicious message while you are checking it.

5. If the request is confirmed as genuine, use the safest available document route.

   • Use a secure portal reached by typing the known official web address yourself, or by signing in through an app you already use.
   • Ask whether in-person verification, post, or certified copies are accepted instead of high-quality scans.
   • Send only the exact pages, sides, and document types the verified organisation asks for.

6. Limit reuse risk before sending images.

   • Cover or crop unrelated information where the verified organisation says this is acceptable.
   • If proof of address is needed, avoid sharing unnecessary transaction details.
   • If you upload an image, you can add a clear note on the image such as “For [organisation name] compliance review only, [date]”, as long as the organisation confirms this will not make the document unacceptable.

7. If you already clicked a link, uploaded documents, or gave details, contain the risk now.

   • Stop using the link, email thread, or number from the notice.
   • Contact the real organisation through verified details and say your ID documents may have been sent through an impersonation route.
   • Change the password on any account you signed into during the process and turn on 2-step verification where available.
   • If money was requested, money was lost, or an account was hacked, report it to Report Fraud if you are in England, Wales, or Northern Ireland. If you are in Scotland, report fraud to Police Scotland by calling 101.