How to spot a fake age-verification page before sharing ID

A text arrives saying you must verify your age within ten minutes or lose your account. You had been on an adult website that morning, so the timing feels plausible. Leave the link alone. Open the service separately using a saved bookmark or the address you already know, then look for the same request there. If an alert exists only in the message, ask the service about it through its normal support channel.

Genuine UK age checks can involve a selfie, an identity document or a bank. That gives a convincing fake plenty of material to copy. The most useful question before sharing anything is how you got from the site you intended to visit to the company now asking for evidence.

Trace the handover to the verifier

A website may use an external checker, so a change of domain can be legitimate. Before taking the picture, look for the checker's name and the available methods in the original site's age-check statement. Open the provider's privacy and support details from a trusted starting point. Compare the service name, domain and method. A logo copied into a pop-up proves very little.

Read the hostname from the right end. In the invented address verify.example.org, the service sits under example.org. In example.org.verify.example.net, the address sits under example.net. On a small screen, tap the address bar to see the whole name. An HTTPS connection encrypts traffic to the displayed domain, including when that domain belongs to a scammer.

Does the permission match the method?

A small pending card authorisation is possible with a legitimate card-based age check. Its presence alone tells you little. A real example is Yoti's published explanation of a temporary card hold. Compare what a specific verifier says before you submit card details with what your bank asks you to approve. A subscription or ongoing payment is a separate decision. Yoti's description of card checks · Open Banking's consumer security guide

If you have already entered something

Opened the page but entered nothing? Close it. You can report the suspicious URL to the National Cyber Security Centre without completing the form or returning to the website. If a message delivered the link, retain it for reporting. Report a scam website to the NCSC

Entered a password? Go directly to the genuine service and change the password, and change it anywhere else you reused it. Review signed-in sessions and enable two-step verification where offered. If the account is already inaccessible, use its official recovery route.

Shared bank details or approved a payment? Contact your bank immediately through its app or the number on your card. Explain exactly what you entered and what you authorised. A caller who offers to move your money to a “safe account” is another reason to hang up and call independently. NCSC guidance after sharing sensitive information

Uploaded an identity document? Record the domain, time and type of document you sent. Speak to the document issuer through its official contact route for advice specific to the document. Keep the original message or reference for a report and avoid sending another image to someone offering to recover it. If you believe you have been a victim of fraud, the NCSC directs people in England, Wales and Northern Ireland to Report Fraud and people in Scotland to Police Scotland.

If the verifier is genuine and your concern is how long it can keep the evidence, the next step is different. Read how to ask for your age-check data or its deletion for a request you can send to the organisation responsible.