How to Check a Suspicious Text, Email, or Phone Call Before You Reply

Overview

Phishing scams, text scams (smishing), and phone scams (vishing) often imitate a bank, delivery company, employer, government office, colleague, or person you know. The visible sender name, phone number, logo, and caller ID are not proof of identity. Sender addresses and caller IDs can be spoofed, and a legitimate-looking message can still direct you to a fraudulent website or payment request.

The safest starting rule is simple: pause, do not use the contact details in the message, and verify through a separate trusted route. Do not open an unexpected attachment, follow a shortened link, call a number supplied by the caller, or provide a password, one-time code, payment, or identity document while you are still assessing the request.

Use the following sequence for almost any unexpected contact:

1. Pause. Treat urgency as a reason to slow down, not a reason to act.
2. Preserve context. Save the message, email headers if available, phone number, voicemail, link, and attachment details without interacting with them.
3. Inspect. Look at the actual sender address, destination domain, request, and timing.
4. Verify independently. Use an official app, a website you type yourself, a known phone number, or a colleague’s established contact method.
5. Report and remove. Mark the message as spam or phishing, notify the relevant organization through a trusted channel, and delete it after preserving evidence if needed.

For a broader process covering links, websites, calls, and payment requests, see this online scam checker workflow.

Checklist by scenario

Suspicious text message

• Check whether the text creates pressure about a package, bank account, unpaid bill, account suspension, job opportunity, or prize.
• Be cautious with shortened links, links that do not match the claimed organization, and messages asking you to “confirm” personal or payment information.
• Do not reply with a verification code, even if the sender says it is needed to cancel a transaction or secure your account.
• Open the organization’s official app or type its known website into your browser instead of using the text link.
• Use your mobile provider’s reporting or spam controls where available, and report phishing text through the appropriate channel for your region or organization.

A bank text scam or package delivery scam may use familiar branding and plausible details. The question is not whether the message looks professional; it is whether the request can be confirmed independently without using the message.

Suspicious email

• Expand the sender details and inspect the complete email address, not only the display name.
• Hover over links without clicking, if your email client supports this, and compare the destination with the organization’s genuine domain. Watch for misspellings, extra words, unusual subdomains, and unrelated domains.
• Be cautious with unexpected invoices, password-reset notices, shared documents, delivery updates, refund offers, and requests to change bank details.
• Check whether the message is consistent with your recent activity. An invoice from a company you have never used, for example, deserves independent confirmation.
• Do not rely on grammar alone. Carefully written messages can be fraudulent, while legitimate messages can contain errors.

For invoices and attached documents, compare the request with a previous bill or an established contact at the company. The fake invoice scam guide provides additional checks for billing emails, PDFs, and payment requests.

Unexpected phone call or voicemail

• Assume caller ID is only a clue. A familiar area code, business name, or phone scam number does not authenticate the caller.
• Ask for the caller’s name, department, case reference, and reason for calling, then end the call. Do not let the caller keep you on the line while you investigate.
• Call back using a number from an official statement, card, contract, website you typed yourself, or trusted contact list.
• Never disclose a one-time passcode, password, remote-access approval, full payment details, or identity information merely because the caller sounds convincing.
• Be especially cautious when the caller demands gift cards, cryptocurrency, wire transfers, payment-app transfers, or immediate cash.

A legitimate organization may still contact you unexpectedly, so the goal is not to identify every call from appearance alone. The goal is to move the conversation to a trusted channel before taking action.

What to double-check

Before responding, examine the request itself. Scammers often combine several small warning signs:

• Urgency: threats of arrest, account closure, missed payroll, lost delivery, or a limited-time opportunity.
• Secrecy: instructions not to consult a manager, family member, bank, or support team.
• Unusual payment: gift cards, cryptocurrency, payment apps, prepaid cards, or a request to move money to “protect” it.
• Credential pressure: requests for passwords, multifactor authentication codes, recovery keys, or approval of a login you did not initiate.
• Identity mismatch: a sender address, callback number, link, signature, or payment account that does not match the claimed organization.
• Unexpected change: new bank details, a different delivery address, a new payroll account, or a request to bypass normal approval.

Do not treat a security seal, familiar logo, professional signature, or search-engine result as conclusive evidence. Search results can include misleading advertisements or copied websites. If you need to inspect a website, type the address yourself and compare the domain, contact information, and account activity. You can also use this website and URL verification checklist.

Common mistakes

1. Replying to ask whether it is real. A reply confirms that your number or address is active and does not authenticate the sender.
2. Calling the supplied number. It may connect directly to the scammer or an accomplice. Find the number independently.
3. Clicking first and investigating later. Even if you do not submit information, a link can lead to a convincing imitation or unwanted download.
4. Trusting caller ID or a display name. These can be manipulated and should not replace independent verification.
5. Sharing a one-time code. A code can help someone complete a login, reset, or transaction. Treat it as private authentication information.
6. Relying on a single red flag. A message can look polished and still be fraudulent. Consider the whole request, its timing, and the requested action.
7. Deleting evidence immediately. Preserve screenshots, full headers, phone numbers, URLs, receipts, and timestamps before reporting or deleting the message if you may need them for account recovery or a report.

If you already clicked, replied, paid, or shared information, stop further contact and secure the affected account from a trusted device. Change reused passwords, review active sessions and account changes, contact the relevant financial provider through an official channel, and consider an identity theft protection checklist. Report the phishing email or text through the platform’s reporting option and keep your records.

When to revisit

Keep this checklist available for moments when you are tired, busy, traveling, or handling an unusual request. Revisit it before seasonal planning cycles, major software or workflow changes, tax or benefits periods, school or hiring cycles, and any time your organization changes payment, login, delivery, or support procedures. These are useful review points because scammers commonly imitate whatever process people are currently expecting.

Update your trusted contact list when banks, employers, vendors, schools, or service providers change their websites, apps, phone numbers, or approval workflows. For teams, turn the checklist into a short standard operating procedure: no payment or credential change based solely on an unexpected message, and every sensitive request must be verified through a separate channel.

Printable decision checklist: Did I pause? Did I avoid the supplied link or number? Did I inspect the full sender or destination? Is the request urgent, secret, or unusual? Does it ask for a code, password, payment, or identity document? Did I verify it through a trusted independent channel? If any answer raises doubt, do not reply or pay yet.