How to Spot a Scam Email, Text or Call

You can spot a scam by looking for two things together: someone you trust (or seem to trust) and a reason to hurry. Almost every scam email, text message and phone call uses both. When you notice them, stop, do not click or reply, and check with the real person or company in a way you choose yourself.

This guide covers the signs in messages, web pages and calls, and what to do about each. It is short enough to read in one sitting and plain enough to send to a family member.

The pattern behind every scam: trust plus urgency

A scammer has one job: make you act before you think. To do that they borrow trust and add pressure.

Borrowed trust can be a bank, a delivery company, your manager, a government office, a famous brand or a relative. The message uses the right logo and the right tone. Today it is easy to copy both.

Pressure can be a deadline ("within 24 hours"), a threat ("your account will be closed"), a prize ("you have won") or a secret ("do not tell anyone"). Fear and excitement both work, because both make us act fast.

So the first habit is simple. When a message makes your heart beat faster, treat that feeling as the warning sign. Put the phone down for one minute. Real banks, real managers and real delivery companies can wait one minute. Scammers need you not to.

A second sign is a request to do something unusual: pay in gift cards, move money to a "safe account", install a program, read out a code, or keep a payment secret. Real organisations do not ask for these.

Who really sent this message

The name you see is not proof. A sender name is just text that anyone can set. Look deeper.

In email:

Open the sender details and read the full address, not just the name. A message from "Your Bank" can come from an address that has nothing to do with your bank.
Look for addresses that are almost right: one letter changed, an extra word added, or a different ending after the dot.
Remember that the real address can also be copied or a real account can be hacked. A message from a real colleague can still be a trick if the request is odd.
Hover over a link (or press and hold on a phone) to see where it really goes. Do not click to find out.

The longer guide is is this email really from the sender.

The safest habit does not depend on spotting tiny details. If a message asks you to act, do not use the link, number or attachment in it. Open the company's app, or type its website address, or call the number printed on your bank card or in your contract. Then see if there is really a problem.

Delivery and shopping texts

"Your parcel could not be delivered. Pay a small fee to book a new time." This is one of the most common scams, because almost everyone is waiting for a parcel at some time.

Signs:

The text comes from a number or name you do not know, and there is no order number you recognise.
It asks for a small payment or your card details to release the parcel.
The link goes to a website that is not the delivery company's own address.
It says you must act today.

What to do: do not tap the link. If you are expecting a parcel, open the shop's app or the delivery company's official app, and use the tracking number from your order. Delete the text. Most phones also let you report a text as junk. See the package could not be delivered text scam for more.

A worked example: Jin orders shoes on Monday. On Wednesday he gets a text with a link: "Parcel held. Confirm your address." He checks his order email, finds the real tracking page by typing the delivery company's name, and sees the parcel is on its way with no problem. The text was a scam. Jin spent two minutes and lost nothing.

Fake sign-in pages

A fake sign-in page looks just like the real one: same colours, same logo, same boxes. When you type your username and password, you send them straight to the scammer.

Signs:

You reached the page from a link in a message, not by typing the address or using your bookmark.
The address in the browser bar is not exactly the website you expect. Check the part just before the first single slash. That part tells you whose page it is.
The page asks for more than usual: your card number, your date of birth, the code from your phone.
Your password manager does not offer to fill in your password. This is a useful clue: a password manager only fills in on the real address.

What to do: close the page. Open the real site yourself. If you already typed a password, change it at once from the real site and turn on two-step verification. The guide to spotting a fake login page goes through examples.

Fake verification and CAPTCHA pages

A real CAPTCHA asks you to tick a box or pick pictures of traffic lights. A fake one asks you to do something that is not a puzzle: press a key combination, open a window on your computer and paste text into it.

That is an attack. The text you paste is a command that installs harmful software on your computer. No real website needs you to run a command to prove you are a person.

What to do: close the page. Do not press the keys, do not paste anything. If you already did, disconnect the computer from the internet and tell your employer's IT team (for a work computer) or a trusted support service (for a home computer) straight away. Read more in what to do when a fake CAPTCHA asks you to paste a command.

Unexpected calls and remote access

Phone scammers often pretend to be from a bank, a phone company, a computer company or a government office. They say there is a problem with your account or your computer. Then they ask you to do something: give a code, move money, or let them control your computer.

Signs:

You did not expect the call.
The caller knows your name and perhaps some details. This does not prove anything. Scammers buy lists and read social media.
They ask you to install a program so they can "see your screen".
They say you must not hang up or tell anyone.
They ask you to read out a code that was just sent to your phone.

What to do: say "I will call you back," hang up, and call the number printed on your card, your bill or the official website. Wait a minute first, or use a different phone, because some scammers keep the line open. Never give someone control of your computer unless you started the contact yourself and you trust them. See a caller asked for remote access to my computer.

If you already let someone in: disconnect from the internet, turn off the computer, then ask your IT team or a trusted support service for help. Contact your bank if you shared payment details.

Your boss, your bank, your family: impersonation

Impersonation is the heart of many scams. The sender pretends to be a person you would not question.

Your boss

An email or chat message "from your boss" says: "I am in a meeting and cannot call. Please buy gift cards for a client and send me the numbers. I will pay you back." Scammers choose the names from public company pages. The tone is short and urgent on purpose.

Real managers do not ask staff to buy gift cards in secret. If you get a message like this, do not reply. Check with your manager in person, by a phone call to a number you already have, or in your company's chat. Report it to your IT or security team. The guide to a boss asking you to buy gift cards by email shows the full pattern.

Your bank

A message or call saying your account is in danger and you must move your money to a "safe account" is always a scam. A real bank never asks you to move money to protect it. Hang up and call the number on your card.

Your family

"Mum, I lost my phone. This is my new number. Can you send me some money?" or a call from a person who sounds like your grandchild, crying, asking for money for a hospital or a fine. The scammer uses panic and love.

Agree a family code word now, while everyone is calm. If a message or call asks for money, ask for the code word, or hang up and call the person on the number you already have. See a call from a family member asking for money.

Voice and video that is not who it seems

Software can now copy a voice from a short recording, and it can produce a video of a face that looks real. Scammers use this to make a call or a video meeting seem to come from your boss or a relative.

You cannot reliably tell by listening or watching. So do not rely on your ears or eyes. Rely on process:

For any request for money, passwords, codes or changes to payment details, use a second way to check, such as a call back to a number you already have.
Ask a question only the real person would know, or use your family code word.
Treat urgency and secrecy as warning signs even when the voice is perfect.
At work, follow your employer's rule for payment requests. A good rule needs two people to approve a payment change.

How to report a scam

Reporting protects you and other people. It also helps the real company stop the fake one.

At work: report to your employer's IT or security team using the method they gave you. Do it even if you only suspect a problem. They would rather see ten harmless messages than miss one.
A message in your inbox or phone: use the "report phishing" or "report junk" option in the email or messaging app. Then delete it.
A scam that used a company's name: tell that company through its official website or app.
If you lost money or shared account details: contact your bank straight away using the number on your card, and report the crime to the body in your country that handles fraud. Search for it on your government's official website.
Tell your family and friends what the scam looked like. Scammers repeat the same story with many people.

Do not feel shame. These messages are designed by professionals. What matters is how fast you speak up.

Common mistakes

Trusting the sender name or the logo. Both are easy to copy.
Using the link in the message "just to check". Open the real site yourself.
Calling the number in the message. It reaches the scammer. Use a number from a card, bill or official site.
Replying to "stop" texts. Replying shows your number is active. Delete and report instead.
Acting first and checking later. Reverse the order.
Keeping it secret because you feel embarrassed. Silence helps the scammer.
Assuming you are too careful to be fooled. Everyone is fooled on a tired or busy day. A habit works better than confidence.

Quick reference

Sign	What it often means	What to do
Deadline or threat	Pressure to stop you thinking	Pause for one minute
Unusual payment request	Gift cards, "safe account", secret transfer	Refuse, check with a known number
Link or attachment you did not expect	Fake page or harmful file	Go to the real site yourself
Request for a code	Someone is signing in as you	Never share, change password
Caller wants remote access	Control of your computer	Hang up, call back on a trusted number
Voice asks for money	Possible copied voice	Use a code word or call back

Questions people ask

How can I tell if an email is a scam?

Check three things: the full sender address, whether the message makes you hurry, and whether it asks for something unusual such as a payment, a password or a code. If any of these feels wrong, do not use the links. Open the company's site or app yourself and check there.

What should I do if I clicked a link in a scam message?

Do not enter any information. Close the page. If you typed a password, change it from the real website and turn on two-step verification. If you downloaded a file, disconnect from the internet and tell your IT team or a trusted support service. Then report the message.

Is it safe to reply to a scam message to tell them to stop?

No. A reply shows that your address or number is active, and you may get more messages. Delete the message and use the report option instead.

Can I trust a call if the caller knows my name and address?

No. Scammers buy lists and read public pages. Knowing your details does not prove who they are. Hang up and call back on a number you find yourself.

What if I already sent money to a scammer?

Contact your bank straight away on the number on your card. The sooner you call, the better the chance to stop or trace the payment. Then report the scam to the fraud body in your country. If it was a work payment, tell your manager and IT team at once.

Learn this in five minutes

The track "Suspicious Messages" teaches the core habits in five short lessons: pause before you click, check who really sent the message, treat urgent requests as a warning sign, be careful with unexpected links and files, and report a suspicious message. Each lesson takes about five minutes and lets you practise on realistic examples.