Before You Click: How to Recognise a Suspicious Message

Start with the request, not the appearance

A message may say your account will be suspended, that you have been selected for a job or that a payment needs immediate confirmation. A familiar logo and professional tone do not prove that the request is genuine.

Begin by asking what the sender wants you to reveal, approve, download, pay or change. Passwords, verification codes, account recovery links, payment details and unexpected attachments all deserve independent verification.

Recognise pressure and urgency

Fraudulent messages often try to make careful thinking feel inconvenient. A short deadline, secrecy request or threat of account closure can push someone toward the easiest available action. Urgency is not proof of fraud, but it is a reason to slow down.

For work-related requests involving money, access or sensitive information, follow the organisation’s established process rather than replying to the message or using its contact details.

Examine the sender and destination

Display name, email address and link destination are different things. Look for misspelled domains, unexpected subdomains, shortened links and sign-in pages reached from an unexpected message. HTTPS protects a connection; it does not prove that the website operator is trustworthy.

If the request appears to come from a bank, school, employer or service provider, navigate to the official service independently or use a verified telephone number.

A practical verification routine

Use this five-step routine whenever a message requests a sensitive action.

• Pause. Do not let the message dictate your response time.
• Identify the request. Name the information or action being requested.
• Verify independently. Use an official website, known number or established procedure.
• Avoid the unverified route. Do not use the suspicious link or attachment as your verification method.
• Report and document. Follow the relevant platform or organisational reporting route.

What if you already clicked?

Clicking a link does not automatically mean an account has been compromised. If you entered a password, use the legitimate service’s official route to change it and review active sessions. If you reused that password elsewhere, change it there too.

If you disclosed a verification code, approved an unexpected login, downloaded a suspicious file or exposed financial details, use the provider’s official recovery or support process promptly. For a workplace device, contact the responsible IT or security team. Avoid shame and delay: a quick, calm response can limit further harm.