A suspicious message does not need to look obviously fake to be dangerous. Use this repeatable phishing scam checklist to inspect emails, texts, links, attachments, and login pages without handing over credentials—and to contain the damage if you already clicked.
Overview
Phishing is an attempt to make you reveal information, approve an action, install software, or send money by pretending to be a trusted person or organization. The message may arrive by email, text message, social media, workplace chat, or a phone notification. Some scams imitate banks, delivery companies, cloud services, employers, retailers, or familiar contacts.
The safest approach is not to decide whether a message “looks real” at a glance. Instead, pause the interaction and check several independent signals. A legitimate-looking logo, familiar name, or correctly written sentence is not proof of authenticity. Treat the message as untrusted until you verify the request through a separate route.
This guide focuses on a practical workflow: inspect the sender and destination, assess the request, examine links without opening them, handle attachments cautiously, and take protective steps after a suspected click. It also provides a maintenance schedule so you can revisit your security settings and keep the checklist useful as scam techniques change.
What to track
1. The sender and the conversation history
Start with the complete sender address, not only the display name. A message that appears to come from a company may use a lookalike domain, an unrelated address, or a free email account. Watch for small substitutions such as extra words, swapped letters, added hyphens, unusual country-code endings, or characters that resemble one another.
For a message from a colleague or contact, compare it with previous conversations. An unexpected change in writing style, a new payment request, or a sudden request for secrecy deserves separate verification. Be especially careful when the message claims that a familiar account, invoice, password, or delivery is urgently affected.
2. The request and its pressure tactics
Write down what the sender wants you to do. Common high-risk requests include entering a password, sharing a one-time authentication code, opening an attachment, installing remote-access software, changing payment details, purchasing gift cards, or transferring funds.
Urgency is a warning sign, not proof of fraud. Messages may threaten account closure, claim suspicious activity, offer a refund, or create a short deadline so that you act before thinking. A real issue can still be communicated through a fraudulent message, so verify the situation independently rather than replying to the sender.
3. The destination behind a link
On a computer, hover over a link without clicking it. On a phone, press and hold only if your device displays the destination safely without opening it. Read the full domain carefully. The important part is the registered domain, usually the name immediately before the final extension such as .com or .org. For example, a domain that places a trusted brand name before an unrelated domain is not the brand’s official website.
Shortened links, QR codes, and links that pass through several redirects deserve extra caution because they hide the final destination. Do not paste a suspicious link into a browser merely to inspect it. If you need to access an account, type the known website address yourself, use a saved bookmark you created previously, or open the official app.
4. The website and login page
A padlock or HTTPS connection only indicates that the connection is encrypted; it does not prove that the site is legitimate. Check the domain in the address bar before entering anything. Look for extra words, misspellings, unexpected subdomains, and domains that imitate a service without belonging to it.
Do not use a login page reached from an unsolicited message to test whether your password works. Close the tab and start from a trusted route instead. Browser warnings about deceptive sites, invalid certificates, downloads, or unusual behavior should be treated as a reason to stop, not as an obstacle to bypass.
5. Attachments and unexpected files
Do not open an unexpected attachment simply because it has a familiar file type or appears to come from someone you know. A compromised account can send malicious files from a genuine address. Treat invoices, shared documents, compressed archives, scripts, and files that request macros or additional software as particularly sensitive.
Confirm the file through a separate communication channel. If the file is work-related, use your organization’s reporting and malware-scanning process. A security product can reduce risk, but it cannot guarantee that every new or disguised threat will be identified immediately.
Cadence and checkpoints
Use the following checkpoints whenever a message requests credentials, money, software installation, sensitive information, or an unusual account action:
- Pause. Do not click, reply, call a number in the message, or scan its QR code.
- Inspect. Check the sender address, domain, wording, requested action, and any attachment.
- Verify separately. Visit the organization through a known address or contact the person using a previously trusted number or chat.
- Report and remove. Use the email, messaging, or workplace platform’s phishing-report option, then delete or quarantine the message according to your normal process.
- Review protection. Confirm that operating-system updates, browser updates, multifactor authentication, and antivirus protection are active.
For personal devices, perform a short security review monthly. Check account recovery details, recent sign-ins where available, browser extensions, saved payment information, and installed applications. For a broader routine, use the Monthly Cybersecurity Maintenance Checklist.
For small businesses and technical teams, repeat the review quarterly and after a phishing incident. Confirm that employees know how to report suspicious messages, that high-risk accounts use phishing-resistant authentication where practical, and that payment or password changes require independent verification. Keep the process simple enough that people will follow it under time pressure.
How to interpret changes
One warning sign may be enough to stop, but the absence of warning signs does not establish that a message is safe. Phishing pages can copy branding accurately, use convincing language, and arrive through a real account that has been taken over. Evaluate the entire request and the route by which it arrived.
Pay attention to changes in the pattern of messages you receive. A sudden increase in password-reset notices, fake delivery alerts, payment requests, or messages using a newly popular brand may indicate a campaign aimed at your address, workplace, or community. Record the sender domain, delivery channel, requested action, and any destination shown. This information can help your email provider, workplace administrator, or service provider investigate and block related messages.
Do not confuse a message that is merely unwanted with one designed to steal information or deliver malware. Marketing messages may be annoying but still originate from a legitimate sender; phishing messages typically use deception to obtain access, money, or sensitive data. When uncertain, use the stricter handling process.
If you clicked a link but did not enter information, close the page, avoid downloading anything, and run a security scan if the device behaved unexpectedly. If you entered a password, change it immediately from a trusted device or known-good route. Change it anywhere else you reused it, sign out active sessions where the service provides that option, and review recent account activity. If you submitted payment or identity information, contact the relevant provider through an independently verified channel. For a wider recovery sequence, see the Malware Incident Recovery Checklist.
When to revisit
Revisit this checklist monthly as part of routine online-security maintenance, and immediately after a major phishing attempt, account compromise, device change, or new work system is introduced. Update your trusted bookmarks and contact routes when services change their domains, login flows, or security controls. Review browser warnings and antivirus settings after operating-system or browser updates rather than assuming previous settings remain unchanged.
Teams should refresh internal examples at least quarterly. Replace old examples with recent messages that users actually encountered, while removing live malicious links and attachments. Recheck the organization’s reporting path, authentication requirements, password-reset process, and payment-verification rules. Home users should also revisit the guide when a family member receives a convincing scam or when a new device is added.
When in doubt, do not investigate by interacting with the suspicious message. Verify through a trusted route, report it, and preserve relevant details for support or security staff. Phishing defense is most effective as a repeatable habit: pause before acting, inspect the true destination, verify independently, and secure accounts quickly after any suspected exposure.
