How to Spot a Phishing Scam Before You Respond

Look for the action the sender wants

A message may claim that an account is locked, a payment failed, or an unexpected purchase needs to be canceled. The story creates a reason to act quickly. Focus on the requested action: entering credentials, opening an attachment, moving money, or calling an unfamiliar number.

Spelling errors can be a clue, but their absence does not make a request trustworthy. Scammers can copy branding and write convincing messages. Urgency combined with a request for sensitive information is a reason to stop and verify independently.

Sources: FTC: How to recognize and avoid phishing scams

Use a contact route you choose yourself

Open the organization’s app directly, use a saved website address you trust, or call a number from a statement or the back of your payment card. Do not use the suspicious message’s link or phone number to decide whether that same message is legitimate.

Unexpected texts deserve the same approach. Avoid replying or following a link to resolve an account problem. If the message appears to come from someone you know, confirm through an established contact method, especially when the request involves money or private information.

1. Pause before clicking, calling, or replying.
2. Open the service through a trusted route.
3. Check whether the claimed problem appears there.
4. Ask the organization directly if the request is still unclear.

Sources: FTC: How to recognize and avoid phishing scams · FTC: How to recognize and report spam texts

Protect the code as carefully as the password

Two-factor authentication adds another step to signing in, such as an authenticator code or security key. It helps protect an account if a password is stolen, but a scammer may try to persuade you to hand over that second factor too.

An unexpected caller who asks you to read back a sign-in code may be attempting to access or register an account. Do not share the code with that caller. End the contact and check through the service’s official channel. Use strong, unique passwords so a compromise at one service does not automatically expose another.

Sources: FTC: Use two-factor authentication to protect your accounts · FTC: How verification-code scams work

Match your response to what happened

If you entered a password on a suspicious site, change it through the real service and change any reused password elsewhere. Review account security and sign out unfamiliar sessions when that option is available. If you shared payment details or sent money, contact the financial institution promptly through a trusted number.

If you opened a suspicious attachment or may have downloaded harmful software, update the device’s security software and run a scan. If identifying information was exposed, IdentityTheft.gov can help organize recovery steps. Keep relevant messages and report the incident through the FTC’s official reporting channels.

Sources: FTC: How to recognize and avoid phishing scams · FTC: How to recognize and report spam texts