When an email, text, or QR code asks you to sign in, pay, verify information, or call a number, pause before acting. This reusable phishing-scam checklist shows how to inspect the sender, destination, wording, request, and surrounding context without trusting the message itself.
Overview
Phishing is a deception technique designed to make a message appear trustworthy. The sender may imitate a bank, delivery company, employer, colleague, social network, software provider, or public service. Email-based attacks are often called phishing; text-message attacks are commonly called smishing. A malicious QR code can lead to the same outcome by hiding a website address behind an image.
The safest first step is simple: do not use the message to verify the message. Do not click its link, scan its code, open an unexpected attachment, reply with sensitive information, or call a number supplied in the message until you have checked it independently.
A suspicious message does not have to contain obvious spelling errors. Modern scams can use convincing branding, accurate personal details, copied writing styles, and realistic account notices. Treat pressure and an unusual request as more important warning signs than appearance.
Quick rule: if a message creates urgency and directs you to a new link, phone number, payment method, or login page, stop and verify through a known-good route.
Checklist by scenario
Email: inspect the sender and destination
- Expand the sender details and inspect the complete email address, not only the display name. Look for misspellings, unexpected domains, extra words, unusual subdomains, or a personal address where a business address would normally be used.
- Check the recipient, reply-to address, and message context. A reply address that differs unexpectedly from the sender can be a warning sign, especially when the email requests payment, credentials, or confidential information.
- Hover over links on a computer, or press and hold carefully on a mobile device if your software shows the destination without opening it. Compare the real domain with the organization you expect. A familiar word in a long or unrelated domain does not make the site genuine.
- Be cautious with attachments, including invoices, shared documents, compressed files, and forms you were not expecting. Confirm the request through a separate channel before opening or enabling content.
- Ask whether you were expecting the message and whether the action fits your normal process. An unexpected password reset, payment change, document share, or account warning deserves independent verification.
Text message: answer “Is this text a scam?”
- Be skeptical of messages claiming a missed delivery, unpaid toll, suspicious bank activity, account closure, prize, refund, or employment opportunity when you did not initiate the interaction.
- Do not use the text’s link or phone number to investigate. Open the official app or type the organization’s known website into your browser instead. For a bank or payment account, use the number printed on a card or statement, if available.
- Look for pressure to act immediately, pay a small fee, move a conversation to another app, install software, or provide a one-time code. These requests can be attempts to capture credentials or take over an account.
- Report and block the message using the tools provided by your messaging service or mobile carrier. Preserve the message if it may be useful to your employer, financial institution, or an incident-response team.
QR code: treat the destination as an untrusted link
- Ask where the code came from. A sticker placed over a legitimate code, an unexpected code in a letter, or a code posted in a public location deserves extra scrutiny.
- Preview the URL before opening it when your camera or QR scanner provides that option. Check the domain carefully; a lock icon or HTTPS connection alone does not prove that a site is legitimate.
- Be especially cautious if the page asks you to sign in, download an app, install a configuration profile, allow notifications, provide payment details, or enter a verification code.
- If you scanned the code accidentally, close the page without entering information. If you installed anything or granted permissions, review the device’s apps, browser permissions, and security settings.
What to double-check
The request: Legitimate organizations may contact you, but an unexpected demand for a password, one-time code, full payment-card details, remote access, cryptocurrency, gift cards, or a change to payment instructions should be verified outside the message. Never share an authentication code merely because the requester knows your name or some account details.
The identity: Caller ID, logos, signatures, familiar names, and copied branding can be spoofed. Use a bookmark you created previously, an official app, a known contact, or a number from a trusted statement. Do not search for support using an advertisement or an unverified result when the message itself is the problem.
The link: Read the domain from right to left before the first single slash. The important ownership portion is generally the registered domain, not a brand name placed in a subdomain or path. When in doubt, avoid the link and navigate independently.
The timing and tone: Urgency is a control tactic. A deadline, threat of account closure, warning about legal trouble, or promise of an immediate reward is a reason to slow down, not a reason to bypass normal checks. For more examples of pressure tactics, see common phrases fraudsters use to create urgency.
Your account activity: If you are worried about compromise, check the account directly for recent sign-ins, sent messages, changed recovery details, unfamiliar forwarding rules, or new devices. Use the provider’s official recovery process. Our email security checklist covers settings that can reduce takeover risk.
Common mistakes
- Relying on grammar alone: A well-written message can still be malicious, while a legitimate automated notice can contain awkward wording.
- Trusting a familiar logo: Visual branding is easy to copy. Verify the address, destination, and request instead.
- Calling the number provided: A scammer can answer a phone call and continue the deception. Find contact details independently.
- Scanning first and checking later: QR codes are links in image form. Preview the destination before opening it.
- Entering only “harmless” information: An email address, phone number, or partial account detail can help an attacker make later messages more convincing.
- Ignoring a near miss: If you clicked, entered credentials, approved a sign-in, or installed an app, act promptly. Change the affected password from a known-safe device, sign out other sessions where possible, enable multifactor authentication, contact the relevant financial institution if payment details were exposed, and report the incident through the organization’s official channel.
If a suspicious message caused a download or unusual device behavior, stop using the affected device for sensitive tasks until it has been checked. This guide to malware warning signs on phones and laptops can help you identify symptoms that should not be ignored.
When to revisit
Keep this checklist available for seasonal shopping, tax and benefits periods, travel, major software changes, workplace onboarding, and any time a service changes its login or payment process. Scammers commonly adapt their themes to events that already have the recipient’s attention.
Organizations and household administrators should also revisit internal guidance when email filters, browsers, mobile operating systems, password managers, or authentication workflows change. Update examples when a trusted service changes its domains, notification style, or support process, but do not treat a current brand list as a substitute for checking each message.
Before acting on the next unexpected request, use this five-step routine:
- Pause and avoid the message’s link, code, attachment, and phone number.
- Inspect the sender, destination, request, and urgency.
- Navigate independently to the organization or contact it through a known-good channel.
- Report, block, or preserve the message according to your workplace or service provider’s process.
- If you interacted with it, secure the account and device immediately rather than waiting for clear evidence of harm.
