What are the red flags of this scam?

Your ISP never suspends your service without written notice — an email threatening cutoff in 48 hours unless you click a link is always fraudulent • The link's domain is not bt.com, virginmedia.com, sky.com, or talktalk.co.uk — fake domains use hyphens and extra words such as bt-billing.co.uk, bt-account-verify.co.uk, or virginmedia-billing.net • The fake site asks for your full card number, CVV, and expiry, and often also your sort code and account number — your broadband provider already has this data and can fix a failed payment inside your account portal without re-entering it • You receive the email even though your broadband service is working normally • The sender's email address does not match the official domain — hover over it and you will see an address ending in gmail.com, outlook.com, or an unrelated domain • There is a small 'reconnection fee' (£2.99–£5.99) to 'restore' the service — genuine providers never charge such a fee by email link

What should I do if this happened to me?

Do not click any link in the email. Log into your account directly at bt.com, virginmedia.com, sky.com, or talktalk.co.uk (typed yourself) to check whether there is a genuine billing issue. • Forward the phishing email to report@phishing.gov.uk (the NCSC Suspicious Email Reporting Service) then delete it. • If you already entered card details on a fake site, call your card issuer immediately on the number on the back of your card to cancel and request a replacement. • If you also entered your broadband account password, change it immediately on the real provider website, and change any other accounts where you use the same password. • If you entered your bank sort code and account number, call your bank and ask them to monitor for unusual outbound payments. • Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

HIGH phishing Last reported: 19 Oct 2026 Share

An email from BT, Virgin Media, Sky, or TalkTalk says your broadband payment failed and threatens to cut off your service

Q: Is this a scam?

Yes. This is a documented scam pattern. Fake emails impersonating BT, Virgin Media, Sky Broadband, or TalkTalk claim a direct debit or card payment failed and threaten service suspension within 48 hours. A link leads to a cloned provider website that steals card details and account credentials. Norfolk Trading Standards warned of a BT email spike in October 2026.

Fake emails impersonating BT, Virgin Media, Sky Broadband, or TalkTalk claim a direct debit or card payment failed and threaten service suspension within 48 hours. A link leads to a cloned provider website that steals card details and account credentials. Norfolk Trading Standards warned of a BT email spike in October 2026.

Also known as: fake BT bill email, BT payment failed phishing, Virgin Media broadband scam email, Sky Broadband payment failed email, TalkTalk fake billing email, broadband provider phishing UK

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Do not click any link in the email. Log into your account directly at bt.com, virginmedia.com, sky.com, or talktalk.co.uk (typed yourself) to check whether there is a genuine billing issue.
2 Forward the phishing email to [email protected] (the NCSC Suspicious Email Reporting Service) then delete it.
3 If you already entered card details on a fake site, call your card issuer immediately on the number on the back of your card to cancel and request a replacement.
4 If you also entered your broadband account password, change it immediately on the real provider website, and change any other accounts where you use the same password.
5 If you entered your bank sort code and account number, call your bank and ask them to monitor for unusual outbound payments.
6 Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

Red flags

⚠ Your ISP never suspends your service without written notice — an email threatening cutoff in 48 hours unless you click a link is always fraudulent
⚠ The link's domain is not bt.com, virginmedia.com, sky.com, or talktalk.co.uk — fake domains use hyphens and extra words such as bt-billing.co.uk, bt-account-verify.co.uk, or virginmedia-billing.net
⚠ The fake site asks for your full card number, CVV, and expiry, and often also your sort code and account number — your broadband provider already has this data and can fix a failed payment inside your account portal without re-entering it
⚠ You receive the email even though your broadband service is working normally
⚠ The sender's email address does not match the official domain — hover over it and you will see an address ending in gmail.com, outlook.com, or an unrelated domain
⚠ There is a small 'reconnection fee' (£2.99–£5.99) to 'restore' the service — genuine providers never charge such a fee by email link

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources