An urgent message can make a bad decision feel necessary. Pause before opening attachments, following links, transferring money, or sharing information.
Check the request
Unexpected payment demands, password requests, and requests for verification codes deserve extra scrutiny. Logos and familiar names can be copied. Good spelling is not proof that a message is legitimate.
Check the sender
Look beyond the display name to the full address or phone number. A familiar-looking address is a clue, not a guarantee. Accounts can be compromised and sender details can be spoofed.
Use a separate route
Open the organization’s official app or type a known website address yourself. For a person, use a number you already trust. Do not use the contact information supplied by the suspicious message to verify that same message.
Keep codes private
Do not share passwords, recovery codes, or one-time sign-in codes with someone who contacted you. Do not approve an unexpected sign-in prompt.
If you already responded
If you shared a password, change it through the legitimate service and review active sessions. If you sent money or exposed payment details, contact your financial institution promptly using its official contact method. Report work-related messages to your IT team. Preserve the message if it may be needed for a report.
Was this helpful?
Help us make our guides more useful.
No sign-in needed. This browser remembers your response for up to 180 days.