You’re checking your phone and a message pops up: your delivery has been delayed, your bank account needs attention, or someone you know needs help immediately. It might be genuine. It might also be a phishing attempt designed to make you click before you think.
Phishing is when someone impersonates a person or organization to steal information, money or access to an account. The messages can arrive by email, text, social media or messaging apps. Some are full of spelling mistakes. Others look convincing. A polished message is not proof that it’s safe.
Here are eight signs worth checking, followed by practical steps you can take without putting your accounts at risk.
1. The message wants you to act immediately
“Your account will be suspended in 30 minutes.” “Pay this fee now.” “Don’t tell anyone.” Pressure is a common scam tactic because it gives you less time to verify what’s happening. You do not need to respond on the sender’s schedule. Open the service’s official app or use a web address you already know instead.
2. It asks for a password or verification code
Be especially cautious when a message asks you to enter a password, account number or one-time sign-in code on an unfamiliar page. A scammer may be trying to sign in as you. If you receive a code you did not request, don’t send it to anyone who contacts you unexpectedly.
3. The link goes somewhere unexpected
A message can display a familiar business name while sending you to a different website. On a computer, you can inspect the link destination without opening it. On a phone, the safest choice is usually to avoid the message’s link altogether and open the company’s app or type its known website yourself. Be equally cautious of QR codes in unexpected messages.
4. There’s an invoice, delivery problem or refund you weren’t expecting
Fake order confirmations, overdue bills and package-delivery notices are common hooks. The point is to make you worry about a charge or feel curious about a package. Check your actual orders, transactions or delivery status by signing in through the service directly. Do not use the phone number printed in a suspicious message as your only way to verify it.
5. Someone insists on an unusual payment method
Watch out for a demand to pay through gift cards, cryptocurrency, wire transfers or a payment method that’s hard to reverse—especially if the requester says it’s the only option. Scammers often pair these demands with threats, fabricated emergencies or promises of a prize.
6. The sender’s identity doesn’t match the story
The display name may say “Support,” but the underlying address may belong to a completely different domain. Caller IDs and sender names can also be spoofed. Even a message appearing in an existing conversation deserves scrutiny if the request is out of character. Verify through a contact method you already trust.
7. It pushes you to open an unexpected attachment
An attachment may pretend to be a receipt, contract or security notice. Avoid opening files you weren’t expecting until you’ve confirmed the sender and the purpose. Keep your operating system and security software updated so you have additional protection if something slips through.
8. A friend, colleague or company suddenly makes an odd request
Scammers sometimes use compromised or impersonated accounts. If a friend suddenly asks for gift cards, login codes or urgent money, call them at a familiar number or contact them through another trusted channel. A second conversation can expose a fake request quickly.
How to check a suspicious message safely
- Don’t reply or use its links. Open the company’s official app or a saved bookmark.
- Compare the claim with your account. Check the real billing, order or account-alert screen.
- Verify the sender independently. Use a phone number from an official website, not the message.
- Report it. Mark the email or text as phishing or junk in your messaging app.
- Delete the message once you’ve captured anything needed for reporting.
What if you already clicked?
If you only opened a suspicious page, close it and avoid entering information. If you downloaded a file, update your security software and run a scan. If you entered a password, go directly to the real service, change it, review active sessions, and turn on multifactor authentication. If you shared financial details, contact your bank or card issuer using a trusted number. If you believe your identity was stolen, follow the recovery steps at IdentityTheft.gov.
How to report phishing in the United States
The U.S. Federal Trade Commission recommends reporting suspected scams through ReportFraud.ftc.gov. You can forward suspicious emails to reportphishing@apwg.org and scam texts to 7726 (SPAM), where supported by your carrier.
The takeaway
One red flag doesn’t automatically prove a message is fraudulent. The best habit is simpler: when a message unexpectedly asks you to click, pay or share information, check the claim outside that message first. A minute spent verifying can save hours of account recovery.
Further reading
- FTC: How to recognize and avoid phishing scams
- FTC: How to recognize and report spam text messages
- FTC: How to avoid a scam
