2 min read
The four-check habit
Almost every phishing message fails at least one of four checks. Run them before you act on any message about your finance:
- Sender. Does the address really end @credicorp.co.uk, or is it close-but-wrong like credicorp-secure.com?
- Urgency. Is it pushing you to act immediately — a threat to suspend the facility, a countdown? Manufactured urgency is the scammer's main tool.
- Links. Hover over any link (on a phone, long-press) to see where it really goes. If the visible text and the real address differ, do not click.
- The ask. Is it asking for your password, a code, or a payment to a new account? Genuine Credit Corp messages never do.
A worked example
A typical scam email reads: 'Your Credit Corp facility will be frozen in 2 hours. Verify now to avoid suspension: [Verify account].' The address is alerts@credicorp-verify.net, the link goes to credicorp-verify.net/login, and the tone is urgent. Every check fails — wrong domain, false urgency, a link to a fake login, an ask to enter your password. The correct response is to delete it and, if you want to be sure, sign in by typing credicorp.co.uk yourself.
Smishing works the same way
Scam texts use the same playbook in fewer words: 'CREDICORP: unusual activity detected. Confirm your identity: [link]'. Texts are riskier because links are harder to inspect and the sender name is easy to spoof. Treat any text with a link and a demand as suspect. We will never text you a login link and ask you to sign in through it.
What to do
Do not click, do not reply, do not call the number in the message. If it claims to be Credit Corp, forward it to us — see reporting suspected fraud — and then delete it. If you did click or enter details, change your password at once and follow the recovery steps. Learn what genuine contact looks like in recognising official communications.
Frequently asked questions
I clicked a link but didn't enter anything — am I at risk?
Usually low risk if you entered nothing, but to be safe close the page, run your device's security scan, and change your password if you have any doubt.
How do I check a link on my phone?
Press and hold the link (do not tap) until a preview of the real address appears. If it does not match the sender's genuine website, do not open it.
Are texts more dangerous than emails?
In some ways yes — links are harder to inspect and sender names are easily faked. Apply the same four checks and be extra cautious with any text demanding urgent action.
Related reading
How to recognise genuine Credit Corp communications
Knowing what a genuine Credit Corp message looks like is your best defence against impersonation. We will never…
Read →
Reporting suspected fraud to Credit Corp
If you spot something wrong — a scam pretending to be us, a strange login, an unexpected change — report it…
Read →Invoice and mandate fraud, explained
Invoice fraud tricks you into paying a genuine-looking bill to a criminal's account; mandate fraud changes…
Read →
Protecting director details from impersonation
A director's name, role and correspondence address are public record. That transparency is the law — but a…
Read →Funding for UK limited companies
Credit Corp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.