A suspicious email or text does not need an instant answer. This repeatable verification checklist helps you examine sender details, links, attachments, requests, and urgency cues before you click, pay, reply, or share information.
Overview
Phishing messages are designed to make a risky action feel routine or urgent. They may claim to come from a bank, delivery company, payment service, employer, social network, online retailer, or someone you know. The message might ask you to confirm a payment, reschedule a parcel, unlock an account, review an invoice, claim a refund, or scan a QR code.
A convincing logo or familiar name is not proof that a message is genuine. Sender names can be copied, email addresses can be disguised, and a message can appear in a conversation thread that looks familiar. The safest approach is to treat the message as an unverified alert until you confirm it through a separate, trusted route.
Use this basic rule: do not use the contact details, links, buttons, attachments, or QR codes supplied by a suspicious message to verify that same message. Instead, open the official app or type the known website address yourself. If the issue is real, it should usually be visible after you sign in through the normal route, or you can contact the organization using details from a statement, card, contract, or official site.
If a message sends you to a website, our guides on how to check if a website is legit and using a fake website checker provide a deeper review process. For a quick decision, work through the checklist below.
Checklist by scenario
Bank, card, or payment alert
- Pause if the message says your account will be closed, frozen, or charged unless you act immediately.
- Look for requests for a password, full card number, PIN, one-time code, security answer, or remote access. Do not provide these in response to an unexpected message.
- Open your banking or payment app independently. Check recent activity, alerts, and secure messages there.
- Call the number printed on your card or shown on a statement rather than the number in the text or email.
- Be cautious with messages claiming a payment must be moved to a “safe” account. That type of instruction deserves independent verification.
A bank text scam may use a simple question such as “Did you authorize this payment?” followed by a phone number or link. Even if the message mentions a transaction you recognize, verify it inside the official app or through a trusted number.
Parcel delivery or customs message
- Check whether you are expecting a delivery and whether the sender name matches the carrier you selected.
- Do not assume a tracking number proves authenticity. Copying real-looking reference numbers is easy.
- Be suspicious of small “redelivery,” “address correction,” or “processing” payments requested through an unfamiliar link.
- Find the carrier’s official website independently and enter the tracking information there, if available.
- Do not scan a QR code from an unexpected delivery notice. A QR code can send you to a different site than the surrounding message suggests.
Parcel delivery scams often rely on timing: people may be waiting for an order and click before checking who sent the notice. Verify through your order history or the carrier’s independently opened app.
Payment service or online retailer message
- Check the real sender address, not just the display name. A message labelled “PayPal” or “Amazon” can come from an unrelated domain.
- Inspect the domain carefully for added words, unusual endings, swapped letters, or a brand name placed in the wrong part of the address.
- Open the payment service or retailer by typing its known address or using a saved, trusted app.
- Be cautious of refund, invoice, subscription, and account-verification messages that ask you to call a number or install software.
A fake email example may contain correct branding and polished language while directing you to a mismatched domain. Grammar can be a clue, but good spelling does not establish legitimacy.
Work, social media, or account warning
- Verify unexpected password-reset notices, login alerts, job offers, and collaboration requests inside the relevant platform.
- Check whether the sender’s address or profile is an exact, established contact rather than a lookalike.
- Do not open unexpected documents that request you to enable macros, sign in again, or download a “viewer.”
- For a job offer, confirm the recruiter and organization using independently found contact information. Never let a rushed offer replace normal verification.
- For social messages, contact the person through another established channel if the request involves money, codes, private data, or unusual secrecy.
Impersonation can happen through email, text, messaging apps, or social platforms. A familiar profile picture or name is not enough to confirm identity.
What to double-check
1. The sender and the route
Expand the sender details where possible. Compare the complete email address with the organization’s known domain. Look for extra words, hyphens, misspellings, unexpected subdomains, or free-mail addresses used for an official-looking request. With texts, a short code or sender label is not a guarantee of authenticity because message identities can be imitated or misrepresented.
2. The request itself
Ask what the message wants you to do and why. Requests for passwords, authentication codes, payment details, gift cards, cryptocurrency, identity documents, or remote access deserve a pause. So do instructions to keep the request secret, move a conversation to another platform, or bypass a normal process.
3. The timing and pressure
Urgency is a persuasion technique. “Last warning,” “final attempt,” “suspicious login,” and “respond within minutes” are not proof of fraud, but they are reasons to slow down. A legitimate concern can be checked through an official channel without using the suspicious message.
4. The link destination
On a computer, hover over a link without clicking to preview its destination. On a phone, press and hold only if your device shows a safe preview and you know how to dismiss it. Watch for shortened URLs, unexpected redirects, lookalike domains, and links that do not match the claimed organization. Do not enter information merely because the page uses a padlock or HTTPS; encryption does not prove that the site belongs to the claimed brand.
The safest way to check a link is often not to open it. Visit the organization independently and navigate to the relevant section. If you must investigate a suspicious website, do not sign in, download files, or enter personal information.
5. Attachments and QR codes
Unexpected invoices, forms, shared documents, and compressed files can carry risk even when the message appears personal. Confirm the file through a separate channel before opening it. Treat QR codes as links: inspect the destination before continuing, and never use one from an unexpected message to install an app or log in to an account.
6. The independent confirmation
Use a trusted bookmark, the official app, a card or statement, or a contact method you already know. Do not search for a phone number and assume the first result is official; advertisements and copied support pages can also mislead. If you are checking a message for a business or creator, preserve the original email headers, sender details, and full link for your security team or platform support.
Common mistakes
- Trusting the display name: The visible name can be changed. Inspect the underlying address or profile.
- Relying on grammar alone: Some scams contain errors, but professional wording can also be copied or generated.
- Clicking to “see what happens”: A click can expose a login page, trigger a download, or confirm that your address is active.
- Calling the number in the message: A fake support or refund message may connect you directly to the scammer.
- Assuming a known conversation is safe: An account can be compromised, or a new message can be inserted into a copied thread.
- Sharing one-time codes: A code intended for you should not be relayed to an unexpected caller or message sender.
- Deleting evidence too quickly: Keep the message, headers, screenshots, transaction details, and URLs if you may need to report it.
If you clicked, replied, paid, or shared credentials, act promptly. Change exposed passwords from a trusted device, enable multi-factor authentication where available, contact the relevant bank or service through official channels, and monitor accounts for unusual activity. See our recovery checklist after a scam and guidance on account takeover warning signs. You can also use our guide to report a scam to identify the appropriate reporting route.
Printable five-question check
- Was I expecting this message?
- Does the sender or account exactly match the claimed organization or person?
- What information, money, access, or action is being requested?
- Does the link, attachment, phone number, or QR code need to be used at all?
- Have I verified the request through an independent official channel?
If any answer is unclear, do not act yet. Save the message and verify it another way.
When to revisit
Keep this checklist available before seasonal shopping periods, tax or benefits deadlines, major account changes, travel, and business planning cycles. Scammers commonly adapt their wording to events that already have your attention, such as deliveries, invoices, refunds, hiring, or account upgrades.
Revisit your own verification process whenever you change banks, payment services, devices, password managers, email platforms, or workplace tools. Update bookmarks and saved contact details, remove unused apps, and review which accounts can send payment or password-reset alerts. Publishers, creators, and teams should also agree on a second-person check for unusual payment requests, urgent account changes, and new supplier details.
Finally, return to this guide when a message type changes. New domains, QR-code flows, app prompts, and social engineering scripts can make an old habit less reliable. The durable principle remains the same: pause, inspect the complete request, and confirm through a route you chose yourself.
