Phishing messages are designed to make a risky action feel routine. This reusable checklist shows how to inspect emails, text messages, QR codes, links, payment requests, and brand claims before you respond, click, sign in, or share information.
Overview
A phishing scam warning is not limited to an obviously misspelled email. Modern scams may copy a company’s visual style, use a familiar name, imitate a delivery notification, or arrive through a channel you normally trust. Some messages are technically polished but still malicious because the sender is trying to move you to an untrusted site or pressure you into an unusual action.
The safest approach is to separate the message from the request. Do not decide that an email is legitimate simply because it uses a real logo or appears in a familiar conversation. Ask what the sender wants, whether the request is expected, and whether you can verify it independently.
Use this quick pause test before taking action:
- Stop: Do not click, reply, call a number in the message, scan a QR code, or open an attachment while you are assessing it.
- Inspect: Check the sender, destination, wording, timing, and requested action.
- Verify: Contact the organization through a website, app, phone number, or colleague you already trust.
- Report: Preserve the message and use the relevant reporting feature or security process.
If you are checking a URL, our malicious link checker guide explains what to inspect before opening it. For a broader review of a suspicious site, see this website safety check guide.
Checklist by scenario
Email scam warning
Start with the complete sender address, not only the display name. A message that appears to come from a supplier, executive, bank, or service may use a lookalike domain, an unrelated domain, or a personal mailbox. Be cautious when the visible name seems familiar but the underlying address does not match the organization you expect.
- Expand the sender details and inspect the full address.
- Look for unexpected changes in reply-to addresses.
- Hover over links without clicking and compare the displayed destination with the claimed organization.
- Be wary of attachments you were not expecting, especially when the message asks you to enable content or bypass a warning.
- Check whether the request fits the normal process, timing, and communication style of the sender.
Do not treat grammar as a complete test. Poor wording can be a clue, but a professional-looking message can still be a phishing scam.
Text message scam alert
Smishing messages often use a short deadline: a parcel problem, account warning, payment issue, or verification request. The message may include a shortened link that hides the destination. Instead of tapping it, open the organization’s known app or type its established website address yourself.
- Question unexpected texts about deliveries, refunds, account access, or unpaid balances.
- Do not reply with passwords, one-time codes, payment details, or identity information.
- Never assume a text is safe because it appears in a conversation containing previous legitimate messages.
- Verify the matter through an independent channel before taking action.
Brand impersonation scam
Impersonation attempts commonly borrow a recognizable brand, public figure, employer, supplier, or internal department. Compare the request with the real relationship. A known company may still be impersonated, and a message from a familiar contact may come from a compromised account.
Look for unusual payment instructions, a request to keep the matter secret, a new bank account, an urgent gift-card purchase, or an invitation to continue the conversation on a different platform. For more examples across email, social media, and fake websites, consult the brand impersonation scam tracker.
QR codes and social messages
A QR code is simply a link in a different format; it is not proof of safety. Before scanning, consider where the code came from and what action it supposedly enables. After scanning, inspect the destination address before signing in or entering information. Social media direct messages deserve the same caution as email, particularly when they offer urgent support, investment opportunities, account recovery, or exclusive access.
What to double-check
The destination domain
Read the important part of the address from right to left. In a domain such as login.example.com, the registered domain is usually example.com. A deceptive address might place a trusted name in a subdomain or use a visually similar spelling. Watch for extra words, substituted characters, unexpected country-code endings, and domains that are unrelated to the claimed service.
A padlock or encrypted connection does not establish that a site is legitimate. It only indicates that the connection is protected in a particular way. Domain age, reputation, redirects, and page behavior can provide additional context, but no single automated checker can guarantee safety. See the domain reputation check guide for a structured review.
The requested action
Risk rises when a message asks you to bypass normal controls. Treat requests for passwords, authentication codes, payment changes, remote access, confidential files, or identity documents as high-risk. Verify them using a separate route, not the contact details supplied in the message.
The pressure and the evidence
Urgency is a persuasion technique, not evidence. Pause when a sender threatens account closure, demands secrecy, promises an unusually favorable outcome, or says there is no time to verify. Preserve the original message, headers where available, URLs, screenshots, and transaction details. This record can help your organization investigate or support an online scam report.
Common mistakes
- Trusting the display name: Names are easy to copy; the complete address and context matter more.
- Calling the supplied number: A scammer controls every detail they provide. Find contact information independently.
- Signing in to “check”: A login page reached through an unsolicited message may be designed to collect credentials. Open the known service directly instead.
- Relying on spelling alone: A polished message can still be fraudulent, while a legitimate automated message can look awkward.
- Forwarding the scam carelessly: Forwarding can spread live links or attachments. Use a reporting function or share a safe description with your security team.
- Assuming a warning means you are already compromised: Receiving a suspicious message is not proof that an account was accessed. Assess whether you clicked, disclosed information, installed software, or approved a request.
If you entered credentials or payment information, act promptly: change the affected password from a trusted device, review account sessions and security settings, contact the relevant provider or financial institution through an independent channel, and preserve evidence. For a broader response plan, read what to do after a data breach.
When to revisit
Keep this checklist available before seasonal planning cycles, major purchases, tax or benefits deadlines, travel periods, and organizational changes. Scammers often adapt their themes to events that create genuine urgency. Revisit your process whenever your company changes email tools, identity providers, payment workflows, collaboration platforms, or support channels.
Technology teams should periodically test whether users can view full sender addresses, inspect links safely, report suspicious messages, and verify payment or access changes through an established procedure. Update internal examples when a new impersonation pattern appears. Individuals should review password reuse, multifactor authentication, browser updates, and account recovery details as part of routine consumer cyber safety.
When in doubt, do less in the message and more outside it: close the tab, open the official app or bookmarked site, and contact the person or organization through a trusted route. That pause is the most reusable protection against phishing, smishing, and brand impersonation scams.
