How Can I Tell If an Email, Text Message, or Website Is a Scam?
That suspicious message in your inbox might be a scam. Here's how to spot it in under a minute — before you click anything.
Short answer
Look for four red flags: pressure to act immediately, requests for personal information or unusual payment methods, sender addresses or URLs that are slightly misspelled, and offers that seem too good to be true. Legitimate banks, government agencies, and companies will never ask for your password, Social Security number, or gift card payment by text or email. When in doubt, don't click any links — go directly to the official website by typing it yourself, or call the company using a number you find independently. If even one red flag is present, treat it as a scam until proven otherwise.
Scams used to be easy to spot. Broken English, fake logos, a Nigerian prince who needed your help moving money. Those still exist, but they're not what catches people anymore. The messages that actually steal money look exactly like emails from your bank, texts from FedEx, or alerts from Amazon. Same fonts. Same logos. Same tone. So the question isn't whether it looks legitimate — it probably does. The question is whether it behaves like a legitimate message. That's where scams always slip up.
The Four Red Flags That Show Up in Almost Every Scam
Urgency is the scammer's most reliable tool. "Your account will be suspended in 24 hours." "Act now to claim your package." Real companies don't threaten immediate consequences over text. They send paper mail. They give you time. If a message is designed to spike your heart rate, that's intentional.
Odd sender details are where scams most often give themselves away. The email might say it's from Chase Bank, but the actual address is something like support@chase-alerts-secure.com. Or the link looks right at a glance but hovering over it reveals amaz0n.co instead of amazon.com. One wrong character. That's all it takes.
Strange payment requests are a hard stop. No legitimate organization will ever ask for your password, Social Security number, or bank PIN by email or text. And if anyone asks you to pay using gift cards, wire transfer, or cryptocurrency, that is a scam. Those methods are chosen because the money is nearly impossible to recover once it's gone. Your electric company does not want iTunes gift cards.
Offers that don't add up round out the list. You won a prize for a contest you don't remember entering. A government grant requires a small processing fee. The math never works — there's always a catch that surfaces after you've handed something over.
A Real Example: The $1,200 FedEx Text
A retired teacher got a text saying her FedEx package was held due to an address issue. It looked exactly like FedEx — real branding, a tracking number, everything. It asked her to confirm her address and pay a $3.19 redelivery fee. She clicked the link and entered her debit card number. The fee went through fine.
Three days later, $1,200 was gone across four transactions she didn't recognize. The $3.19 was never about the $3.19. It was about getting her card number. The scammers waited a few days so the connection wouldn't be obvious.
How to Check a Link Without Clicking It
On a computer, hover your mouse over any link and look at the bottom-left corner of your browser — the real destination appears before you click. On a phone, press and hold a link to see a preview of the actual address. For email senders, don't just read the display name. Tap or click it to expand the full address. "Chase Bank" can be the display name for any email address in the world.
The Mistake That Trips Up Smart People
It's not ignorance — it's distraction. Most people who fall for scams aren't confused about the internet. They're busy, tired, or the message arrives when they're already stressed. A scam text about a held package hits differently when you actually are expecting a delivery. That overlap between the fake scenario and your real life is exactly what scammers count on. I'd rather spend 30 seconds being cautious on a real message than lose $1,200 because I was certain I could tell the difference.
If You Already Clicked: Do These Things Now
- Don't enter any more information. Close the tab immediately.
- If you entered a password, change it on the real site right now — and anywhere else you use that same password.
- If you gave payment information, call your bank using the number on the back of your card and ask them to freeze or monitor the account.
- If you gave your Social Security number, go to identitytheft.gov and follow the steps there.
- Report the scam at reportfraud.ftc.gov. It takes five minutes.
Quick Checklist: Run This Before You Click
- Is there a deadline or threat creating urgency?
- Does the sender's actual email address match the company it claims to be from?
- Does the link destination match the real site when you hover over it?
- Is it asking for a password, SSN, or payment via gift card, wire, or crypto?
- Can you verify this by going directly to the company's official site or calling their published number?
If one thing on that list doesn't check out, treat the whole message as a scam. Real companies can wait the two minutes it takes you to verify independently.
Questions people also ask
What if the email has my real name and partial account number — doesn't that mean it's real?
Not necessarily. Scammers buy data from breaches that often include names, partial card numbers, and email addresses. Seeing your name is no longer proof of legitimacy. Always verify through the company's official site or phone number, not through contact details in the message.
Is it safe to click 'unsubscribe' on suspicious emails?
If the sender looks sketchy, skip it — clicking unsubscribe can confirm your email is active and invite more contact. Just mark it as spam and delete it. For companies you actually have a relationship with, unsubscribing is generally fine.
My caller ID showed my bank's real phone number. Can calls be faked too?
Yes. Caller ID spoofing is straightforward, and scammers who impersonate banks use it routinely. If someone calls claiming to be your bank, hang up and call the number on the back of your card yourself.
How do I report a scam text?
Forward it to 7726 (which spells SPAM) — most U.S. carriers recognize that number. You can also report it at reportfraud.ftc.gov, which takes about five minutes.
Can my phone get infected just from opening a text or email?
Simply opening a message is very rarely enough on a modern, updated device. The real risk comes from clicking links, downloading attachments, or entering information. Keep your operating system updated — those updates patch the vulnerabilities that make passive attacks possible.
The Full Guide
Spot Every Scam Before It Steals Your Money
.jpeg)
- Side-by-side visual comparisons of real vs. fake emails from major banks, retailers, and the IRS
- Worked scenarios for 8 common scam types — including romance scams, grandparent scams, and fake job offers — with exactly what to say if you've been targeted
- A printable one-page checklist to keep near your computer or share with a family member who's frequently targeted