This checklist works regardless of how the message reached you — email, text, phone call, social media DM, or even someone speaking to you directly. The delivery channel doesn’t matter; these tactics do.

Before you act on a request involving money, credentials, personal information, or access of any kind, check whether it’s leaning on any of these:

  • Urgency — Am I being told I must act immediately, or something bad happens?
  • Authority — Is this claiming to be from a boss, bank, government agency, or IT/support desk?
  • Familiarity — Is this posing as someone I know or like, in a way that’s making me skip normal scrutiny?
  • Scarcity — Is there an artificial deadline, limited quantity, or “one-time” framing pushing me to decide fast?
  • Consensus — Am I being told “everyone else already did this,” to make it feel normal or safe?

If you checked even one box, stop and verify independently before doing anything else:

  • Don’t use any contact info, link, or phone number provided in the message itself.
  • Look up the organization or person through a channel you already know is real (their official website, a saved phone number, walking over to their desk).
  • If it’s truly legitimate, it will hold up to that extra step. If someone pressures you not to verify, that’s itself a red flag.

When in doubt, slow down. A few extra minutes of verification costs you almost nothing. Skipping it is exactly what the scam is counting on.