Checklists
What to do with a suspicious message
A simple checklist for unexpected texts, emails, and direct messages.
Phishing is a message that tries to get you to reveal information, open a harmful attachment, or visit a misleading website. It may look ordinary and contain no spelling mistakes. Focus on what the message asks you to do.
Key warning signs
- An unexpected delivery fee, invoice, prize, or account warning asks you to act through a link.
- A message asks for a password, payment details, or a verification code.
- An attachment or QR code arrives without a clear reason you can confirm.
- The message uses urgency to keep you from opening your usual app or contacting the sender separately.
What to do
Leave links and attachments alone
Do not open them while deciding. You can check an account without using anything in the message.
Open your usual app or website
Look for the claimed issue there, or contact the organization using details you already trust.
Report, then remove
Use your email or messaging app’s report-spam or report-phishing option. Save relevant evidence first if you lost money or need to report an incident, then delete the message.
What not to do
- Do not reply to prove the sender is real, and do not use an unsubscribe link in a suspicious message.
- Do not assume a padlock symbol or professional writing proves a site belongs to the organization.
- Do not forward an active suspicious link to friends as a warning; describe it or share a screenshot with personal details hidden.
When to get help
If you entered a password, change it through the genuine service and change any other accounts using that password. If you shared payment details, contact the provider. If you opened a file and suspect harmful software, update your security software, run a scan, and seek trusted technical help if needed.
For U.S. scam reporting, visit ReportFraud.ftc.gov. For a personal identity-theft recovery plan, use IdentityTheft.gov. Outside the U.S., contact your local consumer-protection agency.
Try it together
A text says a parcel cannot be delivered until you pay a small fee. You are expecting a parcel. What next?
A safer next step
Check the order through the shop or delivery service you normally use. Expecting a parcel does not verify the text or its link.
Sources & further reading
These public guidance sources informed this resource. Their inclusion does not imply endorsement of the Foundation.
ZoraSafe Foundation · https://www.zorasafefoundation.org/education/suspicious-message