Updated
Quick fix
Be suspicious of urgent messages asking you to click, sign in, pay or share a code. Check the real sender, don’t use links in the message, and verify by contacting the company another way. If you clicked or entered a password, change it right away and tell your IT team.
Step by step
Look for pressure
“Your account will be closed,” “Pay today,” “Unusual sign-in”: urgency is the most common sign of a scam.
Check the sender and links
Look at the full email address, not just the name. Hover over (or long-press) links to see the real address before tapping.
Never share codes
No real company or IT team will ask you to read back a sign-in or verification code.
Verify another way
Go to the website by typing it yourself or call a number you already know, not one from the message.
Watch for payment changes
Emails asking to change bank details or pay an invoice to a new account are a common business scam. Always confirm by phone using a number you already have.
If you clicked
Change the password for that account (and anywhere you reused it), turn on MFA, run a malware scan and tell your IT team.
Report it
Forward phishing emails to reportphishing@apwg.org and scam texts to 7726 (SPAM). Report fraud to the FTC at reportfraud.ftc.gov.