FILE / Technology
How to Spot Phishing Emails and Scam Text Messages Before You Click
Worried you might click a fake bank alert or package notice? Learn how to quickly spot phishing emails and scam texts by checking the sender, previewing suspicious links, and using a short checklist so you can protect your accounts before responding.
Pause, then verify through a separate channel
The safest response to an unexpected message asking for money, account access, or private information is to pause. Do not use its link, attachment, phone number, or QR code to decide whether it is genuine. Open the organization's app yourself, use a known bookmark, or call a number from your card or statement.
Phishing uses messages that impersonate a trusted person or organization to obtain information, steal money, or make you open harmful content. It can arrive through email, texts, social media, or calls. A real logo, your name, a familiar conversation thread, or polished grammar does not prove who sent it.
Warning signs that deserve a closer look
Common patterns include threats of account closure, unexpected delivery fees, surprise prizes, unfamiliar invoices, and requests to confirm payment details. The message may ask you to move the conversation elsewhere, keep a transaction secret, or act before you can check.
Treat these as reasons to verify rather than a scoring system. Genuine alerts can be urgent, and scams can be calm and well written. Attackers may know your employer, purchase history, or a colleague's name. A message can also come from a compromised real account.
| Message asks you to… | Safer verification step |
|---|---|
| Pay a delivery fee | Open the carrier's known website or app and check your tracking record |
| Resolve a bank account problem | Use the bank app or call the number on your card |
| Change a supplier's payment details | Call a previously verified contact, following your payment-approval process |
| Send a password or verification code | Stop; use the service's own sign-in or recovery process |
| Open an unexpected shared document | Confirm with the sender through a separate trusted channel |
Sender names and links are clues, not proof
Expand the sender details if your email app supports it. A familiar display name can conceal an unrelated address. A slightly misspelled domain can be a warning, but a matching address is not a guarantee: sender information can be spoofed, and legitimate accounts can be taken over.
On a computer, hovering over a link can show a destination without opening it. This can reveal an obvious mismatch, but it does not certify safety. Shortened links and redirects complicate inspection. A padlock or HTTPS means the connection to that site is encrypted; it does not prove the site belongs to the organization it imitates.
Do not open an unfamiliar link just to investigate it. On phones, link-preview behavior varies by app, so independent verification is more useful than relying on a press-and-hold gesture. A QR code is also a link path; scanning it does not verify the destination's owner.
Be careful with attachments and security prompts
Unexpected documents, archives, installers, and sign-in requests deserve the same check as a suspicious link. Confirm both the sender and the purpose before opening a file. Do not enable document macros, install remote-access software, or bypass a security warning just because a message says it is necessary.
Do not send someone a one-time code or approve a sign-in prompt you did not initiate. Multi-factor authentication improves security, but some phishing attacks can steal typed codes or trick people into approving access. Use phishing-resistant passkeys or security keys where supported, and keep your device software updated.
Verify without returning to the message
Use the official app or a web address you already know. Check for a matching transaction, delivery record, or account notice. If you are still unsure, contact the organization using independently obtained details. An absent in-app alert does not by itself prove a scam; ask the organization to confirm the request.
For a message from a friend, colleague, or manager, call their known number or use an established separate channel. Do not rely on a new number or payment account supplied in the message you are checking. Work requests involving payments or credentials should follow your organization's normal approval process, even when the request appears to come from a senior person.
Report it and take action if you already responded
Use the email or messaging app's phishing-report option, then delete the suspicious message. Do not reply or click its unsubscribe link. For work messages, follow your security team's reporting procedure and preserve the evidence they request. Reporting options for mobile carriers and public agencies can change, so use their current official instructions.
If you entered a password, go directly to the genuine service from a trusted device, change the password, review recovery details, and sign out unfamiliar sessions. Change it on other accounts where you reused it. If you shared payment information or sent money, contact your bank or payment provider promptly through a verified channel.
If you opened a suspicious file or installed software, stop using that device for sensitive sign-ins and seek help from your organization's IT team or a trusted support provider. Do not assume that changing a password alone removes malware. Record what happened and when so support staff can assess the next steps.