Emails and claims

The Home Insurance Phishing Email That Wants Your Policy Password

Updated 10 November 2026

The costly assumption is that a familiar insurer logo means the message is genuine. A fake policy renewal or claim notice can harvest your password, payment details and identity information before you notice the signs.

The fake policy notice that steals your insurer login

Your home insurer may already have your email address, policy number and payment method. An attacker can use that information to make a fraudulent message look ordinary. The email might claim that a storm payment is waiting, that your identity details need checking or that the policy will lapse unless you sign in.

Do not click through because the branding looks familiar and the details are correct. Examine the actual link without opening it. In most email clients, hover over the button or address and check the destination in the status bar. It should use the insurer's genuine domain, not a shortened address, a misspelled domain or an unrelated sign-in page.

Open the insurer's official app, then look under documents, claims and payments. Alternatively, type the insurer's web address yourself or call the number printed on your policy. If the claim or payment is real, you should be able to confirm it through those independent routes.

If you entered your password on the fake page, change it immediately through the insurer's official site. Sign out of other active sessions, review recovery addresses and multifactor authentication, and check for new payment details or changed contact information. Contact the insurer's fraud or security team if the message included a claim number, policy reference or partial payment information.

Four tells that the email is false

Look at the sender. A display name such as “Claims Support” proves nothing. Check the full address and its domain. Shared inboxes, weird character substitutions and unfamiliar subdomains are warning signs, although attackers can also spoof a familiar display name.

Look at the destination. Hover over every link. A button labelled “Review claim” is not evidence when it points to a generic sign-in service, an insurer lookalike or a shortened URL. If you cannot see the full destination, do not use it.

Look for pressure. “Your policy expires in two hours” and “verify now or lose coverage” are designed to stop you checking. A genuine insurer can still use urgency, but it should not force you to authenticate or pay through an email link you have not independently verified.

Look for unusual requests. Be suspicious of messages asking for a portal password, one-time code, gift card, crypto payment or payment to an individual. Also distrust unexpected attachments, including a supposedly “updated policy” or “claim form”. One login request that lands on an official domain may be normal, but you should still navigate there yourself.

Do not reply merely to ask whether the message is real. Replying confirms that the address is active. Delete or archive the email after reporting it. If you clicked but did not enter anything, close the page, clear the browser data for that site and tell the insurer if the message contained sensitive policy information.

What to do after you clicked the fake claim link

Start with the insurer's official app or website. Change the password if you entered one, and make sure the new password is unique. If the account uses multifactor authentication, check registered devices and recovery methods. Remove anything you do not recognise, but do not accidentally lock yourself out before saving the account recovery details.

Check the insurer account for altered email addresses, phone numbers, bank details and policy beneficiaries. Call the insurer using the number on your policy or official website. Ask whether they have sent a message, created a claim or changed any account details. Ask for the fraudulent message to be removed from genuine threads so you are not confused by a second contact.

Review bank and card statements for payments you did not approve. Contact your bank promptly if the fake page captured card details or if you entered banking information. You may also need to freeze or replace the card. Keep screenshots of the email, the sender address, the link destination and any transaction reference, but do not keep the suspicious link active or revisit the fake site.

Change any password that was reused on the insurer portal. This includes an email account password if you used the same one. A stolen insurer account can expose your address, property details, policy number and financial information, so treat password reuse as a separate compromise.

Report the email to the insurer's published phishing or abuse address, the relevant email provider and Action Fraud if you are in the UK. You can also report a criminal phishing attempt to the National Crime Agency's UK Fraud Reporting Action Fraud service. If there is an immediate risk of financial loss, contact your bank and the insurer first.

Why genuine claim emails can still be dangerous

Some insurance workflows are legitimately time sensitive, particularly after storm damage, flooding or a suspected escape of water. That does not make an unexpected link safe. Genuine communication can also be copied, delayed or seen by someone else. Your verification method should not depend on the message asking you to prove it is genuine.

Use the claim reference in the official app to confirm the status. Save the insurer's genuine domain in your bookmarks once you have verified it, and consider adding the insurer app to your phone. For future notifications, check which email address and mobile number the insurer has on file and review who is authorised to view the policy.

Do not scan a QR code in a suspicious email. A QR code can direct you to a convincing credential page without showing a readable web address. If a broker or comparison service handles the policy, confirm which company is named in the documentation before contacting anyone about the claim.

Red flags become stronger when the message refers to a policy you do not remember, names an unfamiliar adjuster, asks for an unusual form or asks you to keep the issue secret. A real insurer should be able to confirm the matter through your account or a documented contact route.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.