A message says your parcel cannot be delivered. Another claims your bank account is frozen. A third looks like a note from your boss asking for a quick favor.
The goal is often the same: make you act before you think. Phishing messages try to steal login details, payment information, or access to your device. They can arrive by email, text, social media, or messaging apps.
Start with the request, not the logo
Scammers can copy logos, names, and writing styles. A polished message is not proof that it is real. Look at what the sender wants you to do.
Common warning signs include:
- A demand to act immediately or lose access to an account.
- An unexpected request for a password, one-time code, or payment details.
- A link to a delivery or bank page you were not expecting.
- A request to pay using gift cards, cryptocurrency, or another unusual method.
- An attachment you did not ask for, especially one urging you to enable content or install software.
Poor spelling can be a clue, but well-written scams are common too. Do not rely on grammar alone.
Check the claim without using the message
If you have a bank account with the named bank, open your banking app yourself or type the address you already know. If the message claims a package problem, open the retailer or delivery service app directly. For a request supposedly from a friend or colleague, contact that person through a separate channel.
Avoid calling a phone number provided in a suspicious message. Caller ID and displayed sender names can be misleading.
What about a link that starts with HTTPS?
HTTPS encrypts the connection to a website. It does not prove that the website’s owner is trustworthy. A fake login page can also use HTTPS.
Check the full domain name carefully, but remember that lookalike domains can be difficult to spot on a phone. Going directly to the known app or website is safer than trying to inspect a suspicious link.
If you already clicked
Clicking a link does not automatically mean an account was stolen. What you do next depends on what happened.
If you entered a password: Visit the real service directly, change that password, and change it anywhere else you reused it. Turn on MFA and review recent sign-ins.
If you entered payment information: Contact your bank or card provider using an official number and ask what protective steps are appropriate.
If you downloaded or installed something: Disconnect from suspicious activity if needed, update your security software, and run a scan. Seek qualified help if the device behaves unexpectedly.
If you shared sensitive identity details: Follow your country’s identity-theft reporting and recovery process. In the United States, the FTC provides a recovery plan through IdentityTheft.gov.
Quick takeaway
Treat unexpected urgency as a reason to verify, not to hurry. Open the service yourself, contact the sender through a known channel, and never share one-time sign-in codes with someone who contacted you unexpectedly.
Sources and further reading
- FTC: How to recognize and avoid phishing scams
- FTC: Protect yourself from phishing scams
- FTC: How to avoid a scam