Review sender context first
Start by examining who sent the message and how it arrived. Unexpected messages from organizations you deal with, or from colleagues in positions of authority, often signal phishing when they request action. Check whether the email address matches the claimed organization exactly, watching for small alterations such as extra spaces or similar-looking domains. Generic greetings like "Dear customer" instead of your name also point to mass distribution rather than a genuine contact. Taking time with this review prevents hasty decisions that could expose personal details.
Practical steps include opening the message header or sender details panel to see the full address rather than relying on the displayed name alone. Compare that address against records you already hold from prior legitimate interactions. If the message comes through a work system, cross-check the sender against your organization's internal directory using a separate window. Limitations arise when a sender name appears correct but the underlying address has been altered slightly, so always verify both layers before proceeding further.
- Confirm the sender is someone you know or an organization you have an account with
- Look for unexpected or unsolicited messages even from familiar sources
- Note any mismatch between the displayed name and the actual email address
Inspect links and any attachments
Hover over or long-press links without clicking to reveal the true destination. Shortened URLs, addresses that use http instead of https, or destinations that differ from the link text are common red flags. Attachments are rarely sent by legitimate companies in unsolicited messages and can install malware if opened. Never interact with these elements directly; instead, note the details for later verification through official channels. This inspection step reveals attempts to direct you to imitation sites that harvest credentials.
A useful approach is to copy the visible URL text and compare it character by character with the official domain you know. Pay attention to subtle substitutions such as numbers replacing letters or extra hyphens that mimic familiar names. When an attachment is present, treat its presence itself as a warning sign rather than examining its contents. These checks keep the process contained to observation only and avoid any risk of triggering unwanted downloads or redirects.
- Check whether the URL destination matches the displayed link text
- Watch for URL shorteners or slight misspellings of known domains
- Treat any attachment as potentially harmful until proven otherwise through separate confirmation
Evaluate the request and urgency
Phishing attempts frequently ask for personal or financial information, passwords, or immediate transfers. They create pressure with threats of account closure, legal action, or missed opportunities. Real organizations rarely demand sensitive details or sudden actions through email or text without prior notice. Pause to assess whether the request aligns with normal business practices for that sender. Recognizing these patterns helps maintain composure and avoid reflexive compliance.
Break down the message content by listing each specific ask and any deadline mentioned. Compare those asks against typical procedures you have experienced with the same sender in the past. When urgency language appears, note whether it is paired with a request for immediate data entry or payment. This evaluation stage highlights inconsistencies that independent confirmation can later resolve without exposing information.
- Identify any demand for sensitive data such as account numbers or Social Security details
- Note language that threatens consequences for delayed response
- Recognize promises of rewards or quick money as typical lures
Verify through independent channels
If the message appears possibly legitimate, contact the organization or person using contact information you already possess or obtain from their verified public website. Type the address directly into a browser rather than using any link from the message. For colleagues or known contacts, reach them through a separate email thread or phone call. This step prevents malware installation or data exposure even when the message looks convincing. The method ensures the conversation occurs outside any channel the suspicious message controls.
Begin by locating the official website through a fresh search or by typing a known address from memory or personal records. Once there, navigate to the contact section using the site's own navigation rather than any supplied details. When speaking with an individual, reference the original message only after confirming identity through the independent channel. These practices limit exposure while still allowing clarification when the message may be authentic.
- Locate official contact details by searching or typing the known website address yourself
- Use a different communication method to confirm the original message
- Avoid any phone numbers or links provided in the suspicious message
Report and remove the message
Once you determine a message is suspicious, report it through built-in tools in your email or messaging app. Forward phishing emails to reportphishing@apwg.org and text messages to SPAM (7726). You can also submit reports to the FTC. After reporting, delete the message without replying or interacting further. These actions help protect others and reduce the spread of similar attempts. Reporting creates a record that agencies use to track patterns and issue broader alerts.
Use the report function inside the application first because it often routes the message directly to the provider's abuse team. Then forward a copy to the designated external addresses for additional tracking. After both steps, move the item to trash and empty the folder to prevent later accidental opening. This final stage closes the process while contributing to collective defense efforts outlined in agency guidance.
- Use the report spam or phishing option near the sender details when available
- Forward suspicious emails to the Anti-Phishing Working Group address
- Delete the message after reporting to avoid accidental interaction later