Something felt off. Maybe it was a text, an email, a phone call, someone at your door, a letter in the mail. You’re not sure yet if it’s a scam — but your gut is telling you to slow down.

Good. That instinct is the whole game. Here’s what to do with it.

Don’t engage through the same channel

Whatever showed up — a link, a phone number, a reply-to address, a name on a badge — don’t use it to verify itself. This is true no matter the format: don’t click the link, don’t call the number in the text, don’t reply to the email, don’t hand your ID to the person at the door so they can “confirm” who you are.

Scammers count on the path of least resistance. If they hand you the tool to “verify” them, that tool is usually part of the setup.

Verify independently

Go find the real contact information yourself — through a source you already trust and didn’t just receive.

  • For a bank, government agency, or company: use the number on the back of your card, on a past bill, or from the official website you typed in yourself.
  • For a person claiming to be someone you know: call or text them directly, using a number you already had.
  • For someone in person: it’s okay to say “I’m going to verify this before we go further,” and follow up separately.

If it’s real, it’ll hold up to this. Legitimate organizations and people don’t fall apart because you double-checked.

Don’t hand anything over in the moment

Don’t give out passwords, verification codes, account numbers, gift card codes, wire transfer details, or personal information — not “just to confirm,” not “just this once,” not because someone said it was urgent. No legitimate request requires you to do this immediately, while they’re still on the line or at your door.

If you’re being pressured to decide right now, that pressure is information. Real institutions can wait for you to call them back.

Notice the pressure itself

You don’t need to figure out exactly what kind of scam this is to justify stepping back. If something is pushing you to act fast, skip your normal caution, or keep this “between us” — that’s reason enough to pause, regardless of how convincing the rest of it looks.

Report it

Even if nothing was lost, reporting helps:

  • Suspicious texts: forward to 7726 (SPAM) if your carrier supports it, or use your phone’s built-in “Report Junk” or “Report Spam” feature if it has one.
  • Phishing emails: report to your email provider (most have a “report phishing” option) and, if it’s work-related, your IT/security team.
  • Phone scams or anything involving money: report to the FTC at reportfraud.ftc.gov, and to the FBI’s IC3 at ic3.gov if it’s a more serious or financially significant scam.
  • In-person scams: your local police non-emergency line, especially if it involves someone going door-to-door in your neighborhood.

Tell someone

Mention it to a friend, family member, or coworker — especially if they might be a target too. Scammers often work the same script on multiple people in the same building, family, or contact list. A quick heads-up can stop the next attempt before it starts.

For a breakdown of the specific tactics scammers use to create that “something feels off” moment in the first place — urgency, fake authority, false familiarity — see our Checklist: Recognizing Social Engineering.

Updated: