When a message asks you to click, pay, disclose a code, or act urgently, the safest response is not a guess but a repeatable investigation. This checklist helps consumers, developers, and IT teams assess suspicious emails, texts, calls, websites, payment requests, QR codes, and impersonation claims while preserving evidence and reducing the chance of making the situation worse.
Overview
A convincing scam can use a familiar logo, a believable explanation, or information that appears to come from a real company. Sender names and caller ID are easy to imitate, and a legitimate-looking website does not prove that the person contacting you is legitimate. Treat every unexpected request as an unverified claim until you confirm it through a separate, trusted channel.
The central rule is simple: do not use the contact details, links, phone numbers, or payment instructions supplied in the suspicious message to verify the message. Instead, visit the organization’s known website by typing its address yourself, use a trusted application, or contact a person or department through an established channel.
This process is useful for an isolated question such as “is this a scam?” and for recurring security work. Teams can use it to document phishing scam alerts, review fraud domain checks, compare repeated campaigns, and create an internal record of what changed over time. For a broader starting point, see Scam Alerts by Category: How to Check Suspicious Emails, Texts, Calls, and Websites.
What to track
1. The request and its pressure tactics
Record exactly what the sender wants and why the request is supposedly urgent. Common risk indicators include demands for passwords, one-time codes, recovery phrases, card details, gift cards, cryptocurrency, wire transfers, remote access, or copies of identity documents. Be cautious when the message says you will lose access, incur a penalty, miss a delivery, or cause a business problem unless you act immediately.
Urgency is not proof of fraud, but it is a reason to slow down. A legitimate organization should generally allow you to verify an unusual request through its normal support or account process.
2. Sender identity and message metadata
Check the full sender address rather than only the display name. Look for misspelled domains, extra words, substituted characters, unusual country-code domains, and addresses that use a free mailbox when an official business address would be expected. In workplace investigations, preserve the original message and review available headers, including the visible From address, Reply-To address, and delivery path. Header details can provide useful clues, although they should be interpreted carefully and do not alone prove who sent a message.
For texts and calls, record the number, timing, claimed organization, callback number, and exact wording. Caller ID and text sender labels can be spoofed, so verify the claim independently.
3. Links, domains, and destination behavior
Do not click a suspicious link merely to inspect it. On a computer, you can often hover over a link to view its destination, but treat the displayed address as evidence to examine, not as a reason to visit it. Read the domain from right to left: in support.example.com, the important registered domain is generally example.com; in example.com.attacker.test, the registered domain is generally attacker.test.
Watch for lookalike domains, shortened URLs, unexpected redirects, login pages on unrelated domains, and addresses that use a familiar brand only in a subdomain or path. A valid HTTPS connection encrypts traffic to a site; it does not establish that the site owner is trustworthy. If you need more detail, follow the workflow in How to Investigate a Suspicious Website Before You Enter Any Personal Information.
4. Payment instructions and account changes
Verify invoice changes, bank-detail changes, payroll requests, refunds, and urgent transfers using a known contact. Use a second channel, such as a phone number already stored in your records, and confirm the request with the person responsible for the account. Do not rely on a reply to the suspicious email or on contact information contained in an attached invoice.
For organizations, log the requested amount or data type, the affected account, the approval path, and whether the request differs from the normal process. A small deviation in payment instructions can be more important than polished branding.
5. QR codes, attachments, and remote access
A QR code can hide the destination until after it is scanned. Treat unexpected codes in emails, posters, invoices, delivery notices, and messages as untrusted links. Instead of scanning, open the official application or type the organization’s known website yourself. See the QR Code Scam Guide for a dedicated quishing checklist.
Do not open unexpected attachments or enable macros, scripts, or unusual permissions. Never install remote-access software or share a screen because an unsolicited caller says your device, refund, or account requires urgent technical help. If you already granted access, disconnect the device from the network when practical and begin account and device recovery steps.
6. Evidence and a confidence record
Capture the original message, full headers where available, screenshots, URLs, phone numbers, timestamps, attachment names, payment details, and any actions already taken. Do not forward malicious content broadly or upload sensitive evidence to an untrusted analysis service. Redact passwords, authentication codes, personal identifiers, and financial details before sharing a report.
Record a conclusion such as unverified, likely fraudulent, or confirmed through a trusted channel, along with the evidence supporting it. Avoid labeling a message safe simply because no obvious warning sign appeared.
Cadence and checkpoints
Use the checklist immediately when a message requests money, credentials, access, or sensitive information. For a business, add a lightweight review to the security routine:
- Daily: review new reports involving account access, payment changes, executive impersonation, or active credential exposure.
- Weekly: group similar messages by sender infrastructure, wording, domain, phone number, QR destination, and requested action.
- Monthly: update the internal examples library, verify reporting routes, review blocked domains and numbers, and test whether staff know how to escalate suspicious requests.
- Quarterly: reassess trusted contact lists, payment verification procedures, administrator protections, and recovery instructions.
Keep a simple investigation record with the date, channel, claimed identity, destination domain, request type, evidence, decision, and follow-up owner. This makes recurring scam patterns easier to identify without treating every similar message as identical.
How to interpret changes
A change in wording may indicate a new campaign, but it is not enough to establish a new threat. Look for changes across several variables: a new domain, different redirect path, new payment method, altered callback number, new attachment type, or a shift from email to SMS or voice calls. The combination is more informative than any single spelling mistake or visual defect.
Repeated use of the same brand claim with different infrastructure can indicate impersonation rather than a problem with the real company. Conversely, a genuine vendor may change domains or support processes, which is why independent confirmation matters before blocking a business relationship or accusing a sender.
For high-impact incidents, escalate rather than experiment. Contact the affected organization through a known channel, notify your security or fraud team, preserve evidence, and follow applicable reporting procedures. If credentials may have been exposed, change them from a trusted device, revoke active sessions where possible, enable stronger multifactor authentication, and monitor for account takeover signs. The related Account Takeover Warning Signs guide covers the recovery sequence in more detail.
When to revisit
Revisit this checklist whenever a new scam alert reaches your team, a supplier changes payment details, an account shows an unexpected login, or a message introduces a new channel such as a QR code or voice call. Even without a known incident, review the process monthly or quarterly so that contact lists, reporting instructions, and examples do not become stale.
If you clicked a link, entered credentials, approved a login, installed software, disclosed a code, or sent money, act immediately rather than waiting to decide whether the message was fraudulent. Contact the relevant bank, service provider, administrator, or security team through a trusted route; secure the affected account; preserve evidence; and report the message using the appropriate platform or organizational process. For reporting steps, see How to Report Phishing Emails, Texts, and Websites to the Right Place.
The goal is not to identify every scam from appearance alone. It is to create enough friction between an unexpected request and an irreversible action that a claim can be independently verified, documented, and safely handled.
