A Practical Guide to Suspicious Messages

A polished email or familiar company name does not prove a message is genuine. A simple rule helps: pause, avoid the message’s links and contact the organization through a channel you already trust.

WSDK Technology Guide · Published October 28, 2026 · 4 minute read

Recognize the situation, not just the spelling

Phishing messages impersonate a person or organization to prompt you to reveal information, send money, or open a link or attachment. A message may claim there is an account problem, an overdue bill, an unexpected delivery, a job offer, or suspicious activity. Urgency, a request for passwords or payment details, an unfamiliar sender address, a shortened link or an unexpected attachment are reasons to slow down. Good spelling and a convincing logo do not establish that a message is authentic.

Use a safe verification routine

1. Pause. Do not reply, click, scan a QR code or open an unexpected attachment while you assess it.
2. Check whether you expected it. Did you start this conversation, order, payment or account change? If not, treat the request cautiously.
3. Reach the organization independently. Open its official app, type a known website address yourself, or call the number on a card or statement. Do not use the message’s phone number, link or reply address.
4. Keep credentials and codes private. Never send a password or one-time sign-in code in response to an unexpected message.

If a message might be legitimate, the independent check takes only a moment. A real account notice should also be available through the service’s official app or website.

Report and remove it

Use your mail or messaging app’s report-spam or report-junk feature. The FTC says unwanted scam texts can be forwarded to 7726 (SPAM); phishing emails can be forwarded to reportphishing@apwg.org. You can also report the attempt to the FTC at ReportFraud.ftc.gov. After reporting, delete the message.

If you already clicked or replied

Take the next step based on what happened. If you entered a password, go directly to the real service to change it; update that password anywhere else you reused it, and turn on multifactor authentication if available. If you shared bank or card details, contact the financial institution using its official app or the number on your card. If you shared your Social Security number, use IdentityTheft.gov for tailored recovery steps. If you opened an unexpected attachment, update your device’s security software and run a scan; for a work device, follow your organization’s incident-reporting process.

For a broader account-hardening checklist, see WSDK’s passkeys and account security guide. If you suspect your personal information has been exposed, our credit-freeze guide explains how a freeze works, and the digital backup plan covers recovery copies for important files.

References

• Federal Trade Commission: Don’t Take the Bait on Phishing Scams
• Federal Trade Commission: Protect Yourself from Phishing Scams
• Cybersecurity and Infrastructure Security Agency: Avoid Phishing Scams
• Federal Trade Commission: What To Do if You Were Scammed

This guide is general consumer information. If a work account or device is involved, follow your employer’s security reporting procedures.