Suspicious messages rarely need an immediate response. This reusable scam-alert checklist shows how to examine emails, texts, calls, and websites, verify requests through safer channels, preserve evidence, and limit damage if you already interacted with a scam.
Overview
Scams change their wording, branding, and delivery methods, but the investigation process is consistent. Start by separating the message from the action it requests. A request to sign in, pay an invoice, confirm a delivery, share a verification code, install software, or move a conversation to another platform deserves independent verification.
A convincing logo, familiar name, or correct-looking signature does not prove that a message is genuine. Attackers can imitate brands, compromise accounts, register lookalike domains, and use information gathered from public profiles. Treat unexpected urgency, secrecy, unusual payment instructions, and requests for sensitive information as signals to slow down.
This guide is designed for a quick first pass and for more structured review by technology professionals, administrators, and anyone responsible for a shared inbox or business process. If a suspicious website is involved, use the suspicious website investigation guide before entering personal or company information. Do not use the suspicious message itself as the source for verification.
The basic rule
Do not click, reply, pay, download, or disclose information until the request has been confirmed using a trusted route. Open the official application or type a known website address yourself. For a colleague or supplier, contact them using an established phone number, directory entry, or separate conversation. A reply to the original message is not an independent check.
Checklist by scenario
Suspicious email
- Read the full sender address, not just the display name. Look for misspellings, unexpected domains, extra words, or a personal mailbox used for a business request.
- Inspect the destination of links without opening them. A familiar brand in the visible text can lead to a different domain or a shortened URL.
- Compare the request with the sender's normal process. A new bank account, gift-card request, password reset, or urgent invoice change should be independently confirmed.
- Check whether the message pressures you to bypass normal approval, keep the request secret, or act before a deadline.
- Preserve the original message and relevant headers if you may need an email scam investigation, internal review, or report. Avoid forwarding it widely.
For business payment requests, use a second-person approval workflow and verify account changes verbally through a known contact. The fake invoice email scam workflow provides a useful reference for this type of review.
Suspicious text message
- Be cautious with package delivery text scams, account suspension notices, toll claims, prize messages, and unexpected refunds.
- Do not use a link or QR code in the text to resolve the issue. Open the delivery, banking, or service provider's official app independently.
- Never share a one-time passcode because someone claims to be helping you. A request for a code can indicate an attempted account takeover.
- Check whether the message uses a generic greeting, unusual punctuation, a shortened link, or a demand for a small payment before releasing a larger benefit.
- Block or report the message using the functions available on your device, then retain screenshots if the matter may require investigation.
QR codes deserve the same scrutiny as links. A code printed on a notice, posted in a public place, or sent by text can open a fraudulent payment or login page. Review the QR code scam guide before scanning an unfamiliar code.
Suspicious phone call or voicemail
- Do not assume caller ID proves identity. End the call if the caller creates pressure or asks for credentials, remote access, payment, or a security code.
- Call the organization back using a number from a statement, official application, contract, or previously verified contact record.
- Be especially careful when a caller claims that your device is infected, your account is under investigation, or a payment must be moved to a “safe” account.
- Never install remote-access software solely because an unsolicited caller instructs you to do so.
Screen-sharing and refund stories are common elements of technical-support fraud. If you granted access or installed a tool, disconnect the device from networks where appropriate and follow the recovery steps in the tech support scam guide.
Suspicious website or login page
- Check the complete domain, including the spelling immediately before the top-level domain. A secure connection does not establish that the site is legitimate.
- Look for mismatched branding, copied text, poor navigation, unexpected downloads, or a login form reached from an unsolicited message.
- Do not enter credentials to “test” a page. Leave it and navigate to the service through a trusted bookmark or manually entered address.
- Do not upload identity documents, payment details, API keys, recovery codes, or internal files while investigating.
- Record the URL, time, message context, and visible page details, then use a suitable fraud-domain check or reporting process without revisiting the page unnecessarily.
What to double-check
Before deciding whether a message is safe, examine the request from several angles:
- Identity: Is the person, company, phone number, email address, or domain exactly what you expected? A familiar display name is not enough.
- Context: Were you expecting the contact, transaction, delivery, password reset, job offer, or support case?
- Channel: Is the request arriving through a normal channel, or is it asking you to move to a private app, new address, or unfamiliar payment method?
- Action: What happens if you comply? Consider credential theft, malware, payment diversion, identity exposure, or unauthorized account access.
- Verification: Can you confirm the request without using any contact detail or link supplied in the suspicious message?
For accounts, check recent sign-ins, security notifications, forwarding rules, recovery details, and active sessions from the official account interface. If you reused a password and entered it on a suspicious page, change it from a trusted device and update other accounts that used the same password. The account takeover warning guide covers additional recovery checks.
For work systems, preserve evidence before deleting messages and notify the appropriate security or IT contact. Useful details include the original sender, recipient, subject, full URL, attachment name, payment destination, timestamps, and actions already taken. Use the phishing reporting guide to choose the appropriate reporting path for the message or website.
Common mistakes
- Relying on appearance: Professional design, correct logos, and realistic language can be copied. Verify the underlying identity and request.
- Clicking to investigate: Opening a link or attachment is not a neutral test. Use a trusted route or an approved security-analysis process instead.
- Calling the supplied number: A scammer controls every contact method included in the message. Find the number independently.
- Sending a warning by forwarding the scam: Forwarding can expose links, attachments, or personal information to other people. Share a safe summary or use an approved reporting channel.
- Paying a small amount to make a problem disappear: A small request can be used to validate an active target or begin a larger fraud sequence.
- Assuming no harm occurred: If you clicked, replied, paid, installed software, or disclosed information, begin recovery promptly rather than waiting for visible consequences.
If you entered credentials, contact the affected service through its official recovery process, revoke unfamiliar sessions, enable stronger sign-in protection where available, and watch for follow-up impersonation. If payment or identity information was involved, contact the relevant financial provider or identity-support channel using independently verified contact details.
When to revisit
Return to this checklist whenever a new scam alert appears, your organization changes payment or login workflows, or a seasonal event increases message volume. Review it before major travel, hiring cycles, tax or benefits periods, product launches, and other planning cycles that create urgent communications. Update internal examples when suppliers, domains, approval routes, or support tools change.
Teams should turn the checklist into a short response playbook: define who verifies payment changes, where suspicious messages are reported, how evidence is stored, and who can isolate an affected account or device. Test the process when workflows or security tools change, not only after an incident.
When you receive a new suspicious message, pause first. Capture the evidence, identify the requested action, verify through a separate trusted channel, and report it if appropriate. If you already responded, prioritize account protection, payment recovery, and notification of the responsible security contact. That sequence is more reliable than trying to decide whether a message “looks real” after the fact.
