A suspicious email, text, or website does not need to be opened to be investigated. This repeatable workflow shows how to verify the sender, inspect links safely, check domains, preserve evidence, and decide whether to report, ignore, or escalate the message.
Overview
Phishing messages are designed to create a quick decision: click a link, open an attachment, reveal a code, send money, or reply with information. The safest response is to slow the process down and separate the message’s claims from evidence you can verify independently.
An email scam investigation, SMS scam warning, or suspicious-website review should answer five basic questions:
- Who actually sent or registered the message, account, phone number, or domain?
- What action is the sender trying to make you take?
- Where does the link, attachment, QR code, or phone number lead?
- Can the claim be verified through a trusted channel that you find yourself?
- What evidence should be preserved, reported, or shared with your security team?
Do not use the suspicious message itself as your verification channel. If a message claims to be from a bank, delivery company, employer, cloud provider, or colleague, open the organization’s known app or type its established website address manually. Use a phone number from a statement, account page, directory, or previously verified contact rather than a number supplied in the message.
For a shorter decision process, use the Is This a Scam? investigation checklist. It can complement the more detailed workflow below.
What to track
1. The request and the pressure
Start by recording what the message wants. Common requests include signing in, confirming payment details, opening a document, downloading software, buying gift cards, sharing a one-time code, moving a conversation to another platform, or approving an unfamiliar login.
Urgency is not proof of fraud, but it is a useful investigation signal. Note deadlines, threats of account closure, unexpected refunds, unusual secrecy, and requests to bypass normal approval procedures. A legitimate business process should still be verifiable through an independent route.
2. Sender identity and message context
Check the complete sender address rather than only the display name. Look for altered domains, extra words, swapped letters, unusual subdomains, and free-mail addresses used for a supposedly official request. In text messages, record the displayed sender, the phone number if visible, and whether the conversation appears in an existing thread.
For workplace investigations, compare the request with the person’s normal communication style, role, timing, and approval process. A familiar name is not sufficient evidence because sender names, accounts, and message threads can be impersonated.
3. Links, redirects, attachments, and QR codes
Inspect a destination without opening it in your normal browsing session. On a computer, hover over a link to reveal its destination. On a phone, use the link’s preview or copy function without tapping through; the exact steps vary by operating system and app. Paste the copied URL into a text editor so you can read it without navigating to it.
Check the complete domain, not just the words before the first slash. A familiar brand name in a subdomain or path does not mean the brand owns the site. Be cautious with shortened links, multiple redirects, misspellings, unfamiliar top-level domains, and URLs containing encoded or confusing characters. A valid HTTPS connection only indicates that a connection is encrypted; it does not establish that the site is trustworthy.
Do not upload confidential URLs, files, or message contents to a public checking service unless your organization permits it. Security tools can be useful for a fraud domain check, reputation lookup, sandbox review, or hash comparison, but a clean result is not proof that a message is safe. New domains and targeted campaigns may not yet appear in available databases.
Treat attachments and QR codes as links with extra steps. Do not scan a code from an unexpected poster, package notice, invoice, or login prompt until you can verify its source. The QR code scam guide covers common quishing and payment traps.
4. Technical evidence
When the risk is significant, preserve the original message and inspect its technical details. Email headers may show the sending path, authentication results, reply-to address, and message identifiers. These fields require context: authentication can show that a domain authorized a message, but it does not by itself prove that the request is legitimate or that the visible brand claim is accurate.
Record the time received, sender details, subject, destination URLs, attachment names, and any account or payment request. Save the original message file when possible rather than relying only on a screenshot. Screenshots are still useful for visual evidence, especially with text messages or websites that may change.
5. Independent verification and reporting
Verify the claim through a route you locate independently. Sign in through a saved bookmark, contact the organization using a known number, or ask a colleague through a separate channel. Never forward a suspicious attachment internally without following your organization’s security procedure; forwarding can spread a malicious file or expose private information.
After preserving evidence, report the message using the email provider’s phishing function, your organization’s security or help-desk process, the relevant platform’s reporting option, or another appropriate reporting channel. Use the guide to reporting phishing emails, texts, and websites when you are unsure where to start.
Cadence and checkpoints
Investigation is not always a one-time task. Scam campaigns reuse infrastructure, themes, sender identities, and requests. A practical monitoring routine helps technology teams and frequent targets recognize repeat activity without treating every warning as a confirmed incident.
At the time of the message
Do not click, reply, scan, download, or call from the message. Capture the relevant evidence, assess the requested action, and verify independently. If credentials, payment details, or an access code were already provided, move immediately to containment: change the affected password from a trusted device, end active sessions where available, contact the account provider, and follow your organization’s incident process.
During a monthly or quarterly review
Review recurring sender domains, phone numbers, URLs, subjects, attachment names, and impersonated brands. Look for repeated infrastructure or changes in wording. Organizations can compare these indicators with email gateway logs, endpoint alerts, authentication logs, and reports from users. Keep access to collected evidence limited to people who need it, and remove unnecessary personal data from notes and tickets.
Refresh user guidance when a recurring scam changes its delivery method—for example, from email to text, a collaboration platform, or a QR code. The scam alerts category checker can help organize checks by message type.
After a confirmed or suspected compromise
Document what happened, when it happened, what information may have been exposed, and which recovery steps were completed. Watch for follow-up impersonation attempts. A person who responds to one phishing message may later receive calls or messages claiming to offer technical support, refunds, account recovery, or security verification.
How to interpret changes
Not every unusual detail means a message is malicious, and not every polished message is safe. Interpret several signals together rather than assigning a fixed score to one clue.
- Higher concern: the message creates urgency, requests secrets or money, uses a mismatched domain, prevents independent verification, or sends a link to an unexpected sign-in page.
- More evidence needed: the sender is familiar but the request is unusual, the domain is new to your organization, or the message includes an attachment that cannot be verified.
- Lower apparent risk, not proof of safety: the message matches an expected transaction and can be confirmed inside a known account or through an established contact.
Be especially cautious when several small changes appear together: a slightly altered sender address, a new payment account, an unexpected change in tone, and a request to keep the transaction private. These details are more meaningful as a pattern than in isolation.
If a suspicious message concerns a business account, customer data, or privileged access, escalate it even when no one clicked. Early reporting can help security teams search for related messages and block indicators. For possible account compromise, consult the account takeover warning signs and recovery guide.
When to revisit
Revisit this workflow whenever a scam theme changes channel, asks for a new type of information, uses a new domain or phone number, or begins targeting a different group in your household or organization. A monthly review is reasonable for teams that handle frequent external messages; a quarterly review may be sufficient for smaller environments, provided urgent incidents are handled immediately.
Update internal checklists after a real incident, a near miss, a major change to login or payment procedures, or the introduction of a new collaboration, support, or delivery platform. Recheck saved bookmarks and trusted contact routes periodically so verification does not depend on a link supplied by an attacker.
Your next practical step is simple: choose one suspicious message, do not interact with it, record the sender and destination, verify the claim through an independent channel, preserve the evidence, and report it through the appropriate route. If you already entered credentials or payment information, stop investigating and begin account recovery and incident escalation immediately.
