David TaylorNS&I released the June 2026 Premium Bonds prize draw results on 2 June 2026, confirming two jackpot winners of £1 million each and nearly six million prizes worth a combined £376,627,975. Within hours of the draw landing in the news, cybercriminals had already deployed the phishing campaigns prepared in advance — fake SMS messages, lookalike NS&I emails, and impersonation phone calls designed to reach bondholders before they have checked their results safely.
The Actual June 2026 Results
The two million-pound winners are a resident of Leeds — bond number 662EK268242, purchased February 2026 on a holding of £42,425 — and a resident of Cheshire West and Chester — bond number 573GA618329, purchased March 2024 on a holding of £33,800. In what NS&I described as a statistically exceptional result, a Bromley resident also won £100,000 with only £270 held in bonds.
The draw produced 71 prizes of £100,000 and 143 prizes of £50,000 in addition to the two jackpots. The only legitimate ways to verify whether you have won are through the official prize checker at nsandi.com, the NS&I app, or by calling 08085 007 007. NS&I does not proactively contact winners by text, email, or unsolicited phone call.
Why Prize Draw Days Are Cybercriminals' Busiest Moments
Major prize draws follow a predictable calendar — and cybercriminals operate on that calendar too. Phishing campaigns targeting Premium Bond holders are typically prepared weeks in advance and deployed the moment draw results appear in news searches, when interest peaks sharply and recipients are excited rather than cautious.
UK-based NS&I phishing runs use three main formats. SMS messages impersonating "NS&I" or "HM Treasury" claim a prize is waiting to be claimed and request confirmation of personal details. Emails with convincing NS&I branding redirect recipients to fake portals that capture login credentials or banking information. Phone callers identifying themselves as NS&I "security team" members warn of suspicious account activity and request verification of account numbers.
All three formats aim at the same outcome: collecting enough personal and financial data to access a real NS&I account or to execute bank transfer fraud. The UK's National Cyber Security Centre recorded a 38% increase in financial services phishing attacks in the twelve months to March 2026, with prize notification fraud accounting for a growing share of reported incidents.
4 Signs the NS&I Contact Is Fraudulent
1. NS&I reached out to tell you that you have won.
NS&I does not send unsolicited prize notifications by SMS, email, or phone. Winners receive a letter by registered post. Any message — however official the NS&I logo looks — claiming you have won and requiring action from you is fraudulent. The only proactive contact NS&I makes is to notify holders of interest rate changes, and those communications never include links to claim a prize.
2. You are being asked to provide or confirm bank details.
NS&I pays prizes directly into the bank account already registered on your existing account. The organisation will never send a link or make a call requesting payment information in order to release a prize. If a message or caller asks you to "verify your account details" to receive winnings, end the contact immediately.
3. The link or domain is not nsandi.com.
Phishing domains commonly used in NS&I impersonation include variations such as nsat.co.uk, ns-i.gov.uk, ns-and-i.com, and similar constructions designed to look plausible at a glance. If you receive a link relating to your Premium Bonds, do not click it. Open a new browser tab and type nsandi.com directly.
4. You are asked to call a number other than 08085 007 007.
NS&I's only official customer contact number is 08085 007 007, which is free from UK mobiles and landlines. Any other number used to discuss your "account status," "prize verification," or "security issue" is not NS&I. Premium-rate numbers (beginning 09) are a particular red flag.
How to Check Your Bonds Safely
The National Cyber Security Centre recommends treating all unsolicited financial notifications as suspect by default and accessing sensitive accounts only through verified, bookmarked URLs — never through links sent by email or text (NCSC: Phishing guidance for consumers). For Premium Bonds:
- Navigate directly to nsandi.com by typing it into your browser — do not use a link from any message
- Use the official NS&I app, downloaded only through the Apple App Store or Google Play Store (search "NS&I" and verify the publisher)
- Wait for the post: NS&I sends prize notification letters to winners; a letter will arrive within a few weeks of the draw date
- Call 08085 007 007 if you have any doubt about whether a contact you received was genuine
If you receive a suspicious communication purporting to be from NS&I, forward any suspicious email to report@phishing.gov.uk and any suspicious SMS to 7726 (which spells SPAM on a phone keypad). You can also review how NS&I account rate changes have been communicated in the past for context on what genuine NS&I communications look like.
An IT security specialist can assess your organisation's or household's digital security posture, configure phishing-resistant authentication on financial accounts, and advise on the technical controls that reduce exposure to prize notification fraud — particularly for businesses whose employees manage high-value financial accounts as part of their roles.
This article is for informational purposes only. If you believe you have been the victim of fraud, report it to Action Fraud on 0300 123 2040.
