When a message, website, or phone call feels urgent, use this repeatable verification workflow before clicking, replying, sharing information, or sending money. It covers the checks that help you decide, "Is this a scam?" without relying on a suspicious sender's instructions.
Overview
Scams often imitate ordinary business: a delivery notice, account warning, invoice, job offer, government message, or request from someone you know. The branding may look convincing, and caller ID, display names, and sender addresses can be manipulated. Treat those details as clues, not proof.
A reliable scam check separates the message from the claim it makes. First, pause. Then identify what the sender wants you to do, inspect the contact details and links, and confirm the request through a separate trusted channel. Do not use the phone number, link, or reply address supplied by the suspicious message for that confirmation.
Use this basic rule whenever the request involves a password, one-time code, identity document, payment, gift card, cryptocurrency, remote computer access, or an urgent change to account details:
- Do not act from the original message.
- Open the official app or type the known website address yourself.
- Contact the organization or person using information you already trust.
- Save evidence before deleting or reporting the message.
A website or online scam checker can provide useful warning signs, but no single tool should be treated as a final verdict. Combine automated checks with careful review of the domain, request, payment method, and independent confirmation.
Checklist by scenario
Email and text messages
- Identify the requested action. Is the message asking you to log in, pay an invoice, confirm delivery information, share a code, or open an attachment? A request for sensitive information or immediate payment deserves extra scrutiny.
- Inspect the sender. Look beyond the display name. In email, examine the complete address and the actual reply-to address if available. In text messages, a familiar-looking short code or brand name does not establish authenticity.
- Read the link destination. On a computer, hover over a link without clicking. On a phone, press and hold only if your device shows the destination safely. Watch for misspellings, extra words, unusual subdomains, shortened URLs, or a domain that does not match the organization you expected.
- Check the message context. Did you recently place an order, apply for a job, or contact the company? An unexpected message is not automatically fraudulent, but it should not be trusted merely because it sounds plausible.
- Verify independently. Use a bookmark, a manually typed address, or the official app. For a personal request, contact the person through a known number or separate conversation.
Common examples include a bank text scam, a package delivery scam, a toll notice, a fake invoice, and a government impersonation message. The details change, but the verification process remains similar. For more focused examples, see the guides to fake invoice scams and toll text scams.
Websites and login pages
- Check the address bar. Confirm the spelling of the main domain, not just the presence of a padlock or HTTPS. Encryption protects the connection; it does not prove that the site operator is trustworthy.
- Look for fake website signs. Be cautious about broken navigation, copied branding, poor grammar, missing contact details, inconsistent policies, and claims that pressure you to act immediately.
- Inspect the payment and login flow. A site that asks for unnecessary identity details, a password used elsewhere, an authentication code, or an unusual payment method should be treated as high risk.
- Compare through a trusted route. Search for the organization independently or use a saved bookmark. Avoid relying on a sponsored result, social media advertisement, or link provided by the suspicious message.
- Do not test a suspicious site with real credentials. If you need to investigate, use public information only. Never enter a password, payment card, identity number, or one-time code simply to see what happens.
A practical scam website checker checklist can help you review the address, business information, policies, and payment request in a consistent order.
Phone calls and voicemail
- Assume caller ID can be misleading. A local number, a familiar company name, or an apparently official number is not independent verification.
- Ask what the caller wants. Be especially cautious when the caller requests a one-time code, remote access, secrecy, immediate payment, or a transfer to a different account.
- End the call when pressured. You can say that you will call back through an official number. Do not allow the caller to keep you on the line while you search for contact information.
- Verify separately. Find the number on a statement, card, official website you reached independently, or an app you already use. A phone number lookup may reveal patterns, but it cannot establish that a caller is legitimate.
Suspicious calls involving benefits, fines, loans, or account suspension deserve the same pause-and-verify approach. Review the Social Security scam guide or the government impersonation scam guide for scenario-specific checks.
Payment requests and marketplace transactions
- Confirm the recipient and amount using a separate channel. Do not trust changed bank details or a new payment address merely because they appear in an email thread.
- Consider the payment method. Requests for gift cards, cryptocurrency, wire transfers, or payment-app transfers can be difficult to reverse. Treat pressure to use one of these methods as a serious warning sign.
- Keep transactions inside the platform when possible. Moving a marketplace conversation off-platform can remove safeguards and make disputes harder to resolve.
- Do not release goods or codes on the basis of a screenshot. Check the transaction directly in the relevant banking, payment, or marketplace account.
What to double-check
Before deciding that a message is safe, review the following details together rather than focusing on one reassuring feature:
- Domain ownership and spelling: A legitimate-looking brand name may appear in a longer or unrelated domain. Focus on the registered domain near the end of the address.
- Account activity: Open the official service directly and check whether the alleged warning, invoice, order, or security event appears there.
- Timing and urgency: Scammers often create a short deadline, threaten account closure, or claim that someone will be harmed if you delay. Urgency is a reason to slow down, not a reason to skip checks.
- Information already known: Personal details in a message do not prove legitimacy. Information can be copied from public profiles, previous breaches, or compromised accounts.
- Payment destination: Confirm the recipient name, account details, wallet address, and purpose before authorizing anything. If the destination changed unexpectedly, verify it with a known contact.
- Attachment behavior: Do not enable macros, install software, or enter credentials to view an unexpected document. If a work-related file is involved, follow your organization’s security process.
If you already clicked, entered credentials, or sent information, stop further contact and begin recovery promptly. Change exposed passwords from a clean device, prioritize accounts that reuse the same password, enable multifactor authentication where available, and contact the relevant bank or platform through an official channel. For a broader response plan, use the data breach protection guide.
Common mistakes
- Searching the phone number and stopping there: Search results and user reports can be incomplete, outdated, or manipulated. Treat them as supporting evidence only.
- Trusting HTTPS or professional design: Secure connections and polished pages are easy for criminals to use. Inspect the domain and verify the organization separately.
- Replying to ask whether the message is real: A reply confirms that your address or number is active and keeps you engaged with the sender.
- Using the provided contact information: A fraudulent message can supply a fake support number, email address, or chat account. Start from a trusted source instead.
- Sharing a one-time code: Legitimate support staff should not need you to disclose authentication codes. These codes can be used to approve a login or reset.
- Assuming familiarity means safety: A compromised account can send convincing messages to colleagues, friends, or customers. Verify unusual requests even when they appear to come from someone known.
- Deleting evidence too soon: Keep the original message, full headers when available, screenshots, transaction records, phone numbers, URLs, and timestamps. This information may help your provider, workplace, bank, or reporting service investigate.
When to revisit this checklist
Return to this workflow whenever a message asks for money, credentials, identity information, remote access, or an unusual change to a familiar process. It is also worth reviewing before seasonal planning cycles, travel periods, tax or benefits deadlines, major shopping events, and any time your workplace changes its payment, login, or support procedures.
Update your personal process when you change phones, browsers, password managers, payment apps, or multifactor authentication methods. Recheck bookmarks and saved contacts after an organization changes its official website or support workflow. Technology professionals and IT administrators should also revisit internal reporting paths when tools, vendors, domains, or approval procedures change.
Printable quick check: Pause. Identify the request. Inspect the sender and domain. Preview the link. Reject unexpected attachments. Check the official account directly. Confirm through a separate trusted channel. Refuse pressure, secrecy, and unusual payment methods. Save evidence. Report the message through the relevant platform or organization.
If you are still unsure, do not proceed until you can verify the request independently. A short delay is usually less costly than giving a suspicious person access to an account, device, payment method, or identity information.
