A letter has been sent to some customers containing a QR code which directs them to a fake website offering help with paying their bills.
The website then goes on to ask for personal information such as date of birth, address and passport number.
Thames Water says it will never ask customers for their personal or financial details or access to their online account.