Before You Click: 7 Signs an Email or Message May Be a Scam

An unexpected message says a delivery is stuck, an account will close, or a prize is waiting. It may look familiar and ask you to click a link or open a file. Before acting, pause. Phishing messages imitate people or organisations to get you to share personal details, send money, or open something harmful.

Check the sender, not just the display name

Tap or open the sender details and inspect the full email address or account. Does the domain match the organisation’s genuine website? A display name such as “Bank Support” is easy to copy. A misspelled domain or unrelated address is a reason to stop and check through a separate, trusted channel.

Treat urgency as a cue to slow down

“Act in ten minutes,” “your account is blocked,” and “keep this secret” are designed to rush a decision. Real issues can be checked by opening the organisation’s official app or typing its known website address yourself. Do not use the message’s link to verify the message.

Be careful with links and attachments

On a computer, hover over a link to preview its destination; on a phone, press and hold only if you know how to preview safely. If the destination differs from the displayed text, looks shortened, or contains an unexpected spelling, do not open it. Unexpected attachments deserve the same caution, even when the message seems to come from someone you know; their account may have been compromised.

Notice unusual requests

Be suspicious of a request for passwords, one-time codes, payment details, or personal information by email or message. Do not send a verification code to someone who contacts you. Verify payment or account requests using a phone number or website you already trust.

Look for several clues, not perfect grammar

Bad spelling can be a clue, but polished writing is no proof of safety. Consider the whole message: sender, context, link, attachment, and requested action. If one part feels out of place, verify independently.

If you think it is phishing

Do not reply, click, or download. Use the email or messaging service’s report option, then delete the message. If it claims to be from an organisation, report it through contact details found independently on that organisation’s site. If you already entered a password, visit the real service directly, change it, and secure the account; if it involved a payment or financial account, contact the provider promptly through its official channel.

A short pause can prevent a rushed mistake. Make checking the sender and destination part of your routine, especially when a message asks you to act or share sensitive information.