No single clue settles it
There is no one feature that separates a genuine message from a fraudulent one. Real emails can contain typos, and polished scam messages are common. What helps is looking for several clues together and, more importantly, noticing what the message asks you to do. Each red flag below comes with the reason it matters, since the reason is easier to remember than a list.
Clues about the sender
An address that does not match the claimed organisation. An email shows a display name, such as a bank’s, alongside the actual address. Anyone can set the display name to anything. Look at the full address behind it and check that the domain after the @ sign belongs to the organisation. Subtle changes, such as extra words or altered spelling, are the same lookalike domains trick used on websites.
A message from someone you know that feels wrong. Accounts of friends and colleagues can be taken over, and attackers use them to send convincing messages. A request for money, a gift card or a strange link from a familiar contact deserves a check through a different channel.
A text from an unfamiliar number or short code claiming to be an organisation. Text messages can be sent from numbers or names that seem official. The sender name shown is not a reliable proof of origin, so treat it as a claim, not a fact.
Contact you did not expect. Unexpected messages about a parcel you did not order, an account you do not have, or an invoice you do not recognise are worth more suspicion than ones that relate to something you really are doing.
Clues in the wording
Urgency and threats. “Act within 24 hours”, “your account will be suspended”, “final notice”. Pressure shortens the time you spend thinking, which is exactly what the sender wants. Genuine organisations do sometimes set deadlines, but they rarely rely on alarm.
Too-good offers. Unexpected prizes, refunds or easy money invite you to lower your guard. If you did not enter anything, ask why you were selected.
Generic greetings with specific demands. “Dear customer” followed by a request to confirm payment details is not conclusive, since many real mailings are generic, but a request for sensitive details should always make you stop.
Requests for secrets. Real services do not ask you to send a password, a full card number, a PIN or a one-time code by reply. A code in particular exists to prove that you are you; handing it to someone else defeats its purpose, which is how two-factor authentication gets bypassed.
Unusual payment instructions. Gift cards, crypto wallets, transfers to personal accounts or instructions to use payment apps to send money to someone you do not know are common features of fraud, because such payments are hard to undo.
A request for secrecy. “Do not tell anyone” or “do not call the bank” is a major warning. Secrecy prevents the check that would expose the scam.
Odd tone or wording. Strange phrasing, inconsistent formatting or clumsy grammar can point to a scam, although improved writing tools mean polished text is no longer a sign of legitimacy. Treat good grammar as neutral and bad grammar as a mild flag.
Clues in links and attachments
A link that goes somewhere different from its text. On a computer, hovering over a link normally shows the true destination. On a phone, pressing and holding may do it. If the address does not clearly belong to the organisation, do not follow it.
Shortened links. These hide the destination. They are common and often harmless, but in an unexpected message about money or your account they remove the chance to check where you are going.
A login page reached through a message. Even if the page looks right, it may be a copy. Open the organisation’s official app or type its address yourself instead.
Unexpected attachments. Documents, archives and programs can carry malware. Be especially careful with files that ask you to enable macros or editing, or to run an installer. An invoice you were not expecting is a classic example.
QR codes in messages or letters. A code hides the address in the same way a shortened link does. Treat it with the same caution as any unexpected link.
Clues in the channel
Moving you elsewhere. A message that quickly tries to shift the chat to another app, or to a phone call, may be trying to leave a place where it can be filtered or reported.
Messages that arrive at an odd moment or through an odd route. A “bank” that suddenly texts a number you never gave them, or a “colleague” who writes from a personal account, is worth questioning.
What to do when you spot flags
- Do not respond or click. Replying even to say “stop” can confirm that your number is active.
- Verify through a separate route. Contact the organisation using a number or address you already trust, such as the one on a card or on its official website.
- Use the reporting options. Email and messaging apps usually have a “report phishing” or “report junk” option, and many countries have a place to forward scam texts.
- Delete it once reported.
- If you already clicked, change the relevant password from a trusted device and watch the account for unusual activity. If you entered payment details, tell your bank. The steps involved in account takeover recovery cover this in more detail.
Why these clues keep changing
Scammers adapt to whatever filters and habits catch them, so the exact markers shift over time. Message filters and antivirus software catch a great deal, but they are not complete. The enduring pattern is a message that creates pressure and steers you toward an action that benefits someone else. Treat that pattern, more than any spelling mistake, as your main signal that a message deserves a second look.