Phishing messages are designed to make a rushed decision feel reasonable. This practical checklist helps you examine the sender, URL, attachments, login page, QR code, and request before you click, pay, or share information—and gives you a repeatable process for checking suspicious messages over time.
Overview
Phishing is an impersonation technique. The attacker presents a message, website, text, phone prompt, or QR code that appears to come from a trusted organization or person. The goal may be to collect a password, payment-card number, one-time code, recovery phrase, identity details, or access to a work account. Some campaigns instead deliver malware through an attachment or a download.
Learning how to spot phishing scams is less about memorizing one visual clue and more about checking whether several details agree. A familiar logo does not prove that a message is genuine, and a grammatical error does not prove that it is fake. Treat the request, the sender, the destination, and the timing as separate pieces of evidence.
Use this rule whenever a message asks you to sign in, open an attachment, approve a payment, change account details, or disclose a security code:
Pause, do not use the message’s link or phone number, and verify the request through a separate trusted route.
That route might be a bookmarked account portal, a manually typed official website, a known contact in your address book, or an internal help desk. If the request is real, it should still be possible to confirm it without following the suspicious message.
What to track
1. The sender and conversation history
Inspect the complete email address rather than relying on the display name. Compare the domain after the “@” with the organization’s known domain. Be cautious with lookalikes that add a word, change a letter, use an unexpected country-code domain, or rely on a free mailbox for a business request. For text messages, an unfamiliar number, a shortened sender label, or a message that suddenly changes the conversation topic deserves extra scrutiny.
Do not assume that an existing thread is safe. An account can be compromised, or a scammer can imitate a previous conversation. Check whether the request fits the earlier context and whether the sender is asking for something unusual, such as a new bank account, gift cards, password reset, or one-time authentication code.
2. The link and real destination
On a computer, hover over a link without clicking it. On a phone, press and hold only if your device shows the destination safely. Read the full domain, not just the words before the first slash. In secure.example.test-login.com, the controlling domain is test-login.com, not example. Be wary of misspellings, extra words, unexpected subdomains, URL shorteners, and links that use an IP address.
HTTPS and a padlock indicate that a connection is encrypted; they do not establish that the website belongs to the organization it claims to represent. If a message says your account is locked, open the service using a bookmark you created earlier or type its known address yourself. Avoid searching for the login page if the results could include promoted or misleading links.
3. Urgency, pressure, and unusual requests
Phishing messages commonly create a deadline: an account will close, a delivery will be returned, a payment will fail, or a manager needs immediate action. Pressure is not proof of fraud, but it is a reason to slow down. Treat requests for passwords, authentication codes, recovery keys, payroll changes, invoice payments, or remote-access software as high risk.
Look for a mismatch between the claimed relationship and the requested action. A familiar supplier may legitimately send an invoice, but a sudden request to change payment instructions should be verified using an established contact method, not the details in the message.
4. Attachments, downloads, and QR codes
Unexpected attachments deserve the same caution as links. A document that asks you to enable macros, run content, bypass a warning, or sign in to view it may be trying to deliver malware or steal credentials. File names can disguise executable content, so do not rely on the visible extension alone. If you were not expecting the file, confirm its purpose with the sender through a separate channel.
QR codes can hide the destination from a quick visual inspection. A code on a poster, invoice, text message, or email may open a fake login page or payment form. Preview the destination before opening it, and apply the same domain checks you would use for an ordinary link. When possible, navigate directly to the service instead of scanning.
5. The login page and information requested
Compare the page with the service you normally use, but remember that a convincing design can be copied. Check the address bar carefully, avoid entering credentials after following an unsolicited link, and question a page that requests more information than the task requires. A password reset should not require unrelated identity details, and a delivery update should not require a banking password.
If you have already entered a password, change it from the genuine service’s settings page. Change it anywhere else you reused it, and review active sessions, recovery details, forwarding rules, and authentication methods. For account-security steps, our guide to checking whether an email or password appeared in a data breach can help you decide what to review next.
A quick verification decision tree
- Does the message request money, credentials, an authentication code, or a download? If no, continue normally but remain cautious. If yes, pause.
- Were you expecting the request? If no or uncertain, do not use its link, attachment, QR code, or contact details.
- Can you verify it independently? Open a known website, use a previously saved phone number, or contact the person through a separate channel. If verification fails, treat it as suspicious.
- Did you click, download, or submit information? Disconnect from risky sessions if appropriate, change exposed credentials from a trusted device, notify the relevant organization, and report the message through the available reporting tools.
Cadence and checkpoints
Phishing defenses work best when checking becomes a routine rather than a reaction. For personal accounts, review these habits monthly or whenever you receive a suspicious message:
- Confirm that automatic operating-system, browser, and security updates are enabled.
- Review account recovery addresses, phone numbers, active sessions, and multifactor authentication methods.
- Remove browser extensions, apps, or password-manager entries you no longer recognize.
- Check whether email forwarding rules or filters were added without your knowledge.
- Make sure important accounts use unique passwords stored in a reputable password manager.
For a household or small business, use a quarterly checkpoint to test the process: Can everyone identify the official login route? Does the team know who can approve a payment or reset an account? Are suspicious messages reported to a shared contact without forwarding dangerous attachments? Businesses may also want endpoint protection that blocks malicious links and attachments; compare relevant capabilities in our guide to antivirus for small business endpoints.
Keep a simple record of recurring impersonation themes—delivery notices, tax messages, account alerts, invoices, recruitment offers, or support calls. Do not save passwords or sensitive message content in that record. The purpose is to notice patterns and improve verification steps.
How to interpret changes
When a new scam appears, focus on what has changed in the request rather than only on its branding. A campaign may switch from email to text, use a QR code instead of a visible link, or copy the wording of a legitimate notification. The underlying warning signs remain the same: an unverified sender, an unexpected destination, pressure to act, and a request for information or access.
Do not judge safety by a single signal. A message with perfect spelling can still be fraudulent, while a genuine automated notice may contain awkward formatting. Weigh independent signals together. A known sender using a familiar domain is reassuring, but an unusual payment change still requires verification. A browser warning is a strong reason to stop, but the absence of a warning is not proof that a page is safe.
If security software reports a downloaded file, avoid disabling protection simply to open it. Preserve the detection name and file location, then investigate through trusted security tools or support channels. Our guide to checking whether an antivirus detection is real explains a safer way to handle uncertain alerts.
After a suspected compromise, prioritize containment over curiosity. Stop entering credentials into the questionable page, end active sessions, change passwords from a clean device, enable multifactor authentication, and contact the affected service or financial institution through an official route. If malware may have been installed, follow a reputable malware-removal process before restoring normal activity.
When to revisit
Revisit this phishing scam checklist at least quarterly and whenever your main accounts, devices, browsers, or payment processes change. Update it sooner when you notice a new impersonation pattern in your inbox, workplace, community, or industry. Examples and fake domains become stale; the verification method should remain current.
At each review, test four practical questions:
- Do you know the trusted, direct route to your email, banking, shopping, and work accounts?
- Can you identify who verifies a payment, password reset, or account-recovery request?
- Are your browsers, operating systems, password manager, and security tools receiving updates?
- Do you know how to report a suspicious message to the provider, employer, financial institution, or platform involved?
When a message looks suspicious, save limited evidence such as the sender, subject, visible destination, and time received, but avoid forwarding it to other people. Use the organization’s official reporting option or an established security contact. If you shared financial or identity information, contact the relevant provider promptly and monitor the account for unauthorized activity. For broader protection, combine these habits with the settings in our safe browsing checklist and, where appropriate, DNS filtering or other online threat protection.
The safest response is usually the least rushed one: stop, verify independently, and only then decide whether to proceed.
