A convincing message can use a familiar logo, correct spelling and a plausible reason for contacting you. Judging appearance alone is therefore a weak test. A more reliable habit is to separate the message from the action it requests: verify the underlying claim through a route you already know, then decide what to do.
Identify the requested action
Ask what the sender wants: a password, a payment, an attachment opened, a verification code or a phone call. Then ask why that action is necessary now. The NCSC describes common scam pressures such as apparent authority, urgency and emotional manipulation. These are signals to slow down, even when a message appears inside a conversation you recognise.
For example, a delivery message says a parcel will be returned unless you pay immediately. You might indeed be expecting a parcel, which makes the story plausible. Instead of using the message's link, open the retailer's order page or the carrier's application through your normal route. An expected event is context, not proof of the message's legitimacy.
Use an independent route
For an account alert, open the application directly or type the service's known address. For an invoice query, contact the organisation using details already held in your records. For a bank call, end the interaction and use the bank's official contact route. Do not use a replacement phone number supplied by the suspicious message to verify the message itself.
This habit is especially useful for payment-detail changes. A small business might receive an email that appears to come from a regular supplier and introduces a new account. Confirm the change with an established contact using existing details before updating the payment record. Record who confirmed it and how, so the next person is not forced to repeat the same uncertainty.
Treat QR codes and attachments as requests too
A QR code is a way to encode a destination; its graphic appearance does not tell you who controls that destination. Scanning a code in an unexpected account-security email deserves the same independent check as clicking a button. If your device previews an address, inspect it, but do not rely on a quick glance as your only verification method.
Attachments can carry an apparently routine task such as reviewing an invoice or signing a form. If the attachment was not expected, confirm with the sender independently. Avoid enabling unfamiliar document features merely because the file tells you they are required. Organisations should give staff a clear route for reporting uncertainty without blaming them for asking.
Make reporting easy
Use your email provider's reporting feature or your organisation's security procedure. For UK readers, the NCSC provides official guidance on reporting suspicious emails, texts and websites; follow the current instructions on its website. Do not forward suspicious attachments to a group chat with a request that everyone open them and decide whether they look safe.
If a colleague needs context, describe the sender, time and requested action in plain text, or use your approved reporting workflow. Preserve relevant details when instructed by your support team. Reporting is most useful when the person receiving it can identify the message without being exposed to unnecessary additional clicks.
If you already responded
Stop the interaction and act according to what you disclosed. If it involved a password, use a known route to secure that account and any account where the password was reused. If it involved money or payment details, contact the relevant bank promptly through its official channel. If a work device or account was involved, tell your support team without delay.
Keep a short timeline of what happened and what you entered or downloaded. That detail helps the appropriate provider or support team respond. The next habit to build is independent verification at the moment of pressure: a polished message can wait while you confirm its claim elsewhere.
Sources and further reading
This original guide was prepared with AI assistance. Examples are illustrative. The edition date is an assigned date in this 2026 catalogue. See our editorial policy and report a correction.