ScreenConnectHow to spot a scam email before you click
A suspicious email should be verified outside the message. Do not use its links, phone numbers, reply address, or attachments until you confirm the request independently.
Check where the email wants you to click, call, sign in, or pay.
The FTC’s phishing guidance focuses on what a message asks you to do. Scam emails and texts push links, attachments, replies, phone calls, or payments before you verify the request independently. Common examples include fake invoices, antivirus renewals, payroll notices, package delays, account lockouts, shared documents, crypto alerts, and messages impersonating a manager.
The common thread is not the branding. It is the pressure to act inside the attacker’s workflow.
Five checks before you act
- Was the message expected? Unexpected billing, security, or login drama should be treated carefully by default.
- Is the sender only familiar at a glance? Display names can be faked, and close-looking domains are common.
- Does the message want you to use its number, its button, or its attachment? That is the exact path you should avoid.
- Is there pressure to hurry, hide, or skip normal process? Fraud often depends on urgency and isolation.
- Does it mix fear with convenience? “Call now to stop the charge” or “sign in here to avoid suspension” is a classic trap.
One FTC example is especially good because it is so ordinary: fake antivirus renewal emails that try to get you to call a number. The message looks administrative, the amount looks urgent, and the “fix” looks simple. But the phone call is the scam.
How to verify safely
- Do not use the email’s number, button, reply path, or attachment.
- Open the real company site yourself from a known bookmark or by typing the address manually.
- If it is a business request, verify through a separate channel you already trust — not by replying to the same thread.
- If the request involves payment changes, account recovery, or new bank instructions, slow down further and confirm with a known contact.
- If you want a second set of eyes, forward the message to a safer review workflow such as ScamCheck.
The goal is to move the decision outside the suspicious message. Once you do that, most scam emails lose their advantage.
If you already clicked, called, or replied
Stop replying. Use a device you trust to secure the affected accounts.
- Change passwords for any exposed accounts, starting with email and financial logins.
- Review multi-factor authentication, recovery settings, and email forwarding rules.
- If you entered payment information, call the bank or card issuer through a trusted number right away.
- If you downloaded software or granted remote access, review the device for new tools, browser extensions, or persistence.
Scam emails can lead to account theft or a remote-access scam. If the message led to a phone call or remote session, follow the recovery steps in the tech support scam article.
Use these habits for every suspicious message
Good email safety is not about becoming suspicious of everything forever. It is about building a small habit: when a message tries to control the next move, step outside the message before you decide anything. That one pause catches a remarkable amount of badness.
