Is This a Scam? cover
The full guide · 21 pages · PDF

Is This a Scam?

A plain-English guide to spotting fake emails, texts, and websites — before they cost you

Look for these four red flags: pressure to act immediately, requests for personal information or payment through unusual methods, sender addresses or URLs that are slightly misspelled, and offers that seem too good to be true. Legitimate banks, government agencies, and companies will never ask for your password, Social Security number, or gift card payment by text or email. When in doubt, don't click any links — go directly to the official website by typing it yourself or call the company using a number you find independently. If even one red flag is present, treat it as a scam until proven otherwise.

Get the guide — free

What's inside

01
How Scammers Think: The Psychology Behind the Pressure
Urgency, authority, and fear are the scammer's toolkit — recognising them in a message is the first checkpoint.
02
Email Scams Deep Dive: What the Header Is Really Telling You
The sender display name is meaningless — always check the actual email address after the @ symbol.
03
Text Message Scams: Smishing, Fake Parcels, and Bank Alerts
Fake parcel texts use small fees (£1.99) to harvest your full card details — the real theft comes later.
04
Fake Websites: URLs, Padlocks, and Cloned Login Pages
The real domain is what appears immediately before the first forward slash — everything before that can be a misleading label.
05
Five Case Studies: Exactly How Money Was Lost — and How to Stop It
Every case had a single point where one check would have stopped everything — usually the sender address or the URL.
06
The 60-Second Verification Toolkit — and What to Do If You Already Clicked
The 60-second check has five steps: sender address, nature of request, link destination, deadline pressure, and going direct.
07
Scam-Proof Your Household: Scripts, Signals, and the Fridge Checklist
One rule covers most situations: never act on an unsolicited contact. Hang up, close it, then reach out yourself.

Plus 2 fill-in worksheets and a 12-step action checklist.

A page from the guide

Infographic from the guide

Who it's for

An everyday internet user — likely middle-aged or older — who just received a suspicious email, text, or saw a sketchy website and isn't sure whether to trust it or delete it. They've gotten a message that feels slightly off — maybe a bank alert, a package notification, or a prize offer — and they're genuinely unsure if it's real. They're worried about clicking the wrong link, giving away personal information, or losing money, but they also don't want to ignore something that might actually be legitimate.

Questions

What if the email has my real name and partial account number — doesn't that mean it's real?
Not necessarily. Scammers buy data from breaches that often include names, partial card numbers, and email addresses. Seeing your name is no longer proof of legitimacy. Always verify through the company's official site or phone number, not through contact details in the message.
Is it safe to click 'unsubscribe' on suspicious emails?
If the sender looks sketchy, skip it — clicking unsubscribe can confirm your email is active and invite more contact. Just mark it as spam and delete it. For companies you actually have a relationship with, unsubscribing is generally fine.
My caller ID showed my bank's real phone number. Can calls be faked too?
Yes. Caller ID spoofing is straightforward, and scammers who impersonate banks use it routinely. If someone calls claiming to be your bank, hang up and call the number on the back of your card yourself.
How do I report a scam text?
Forward it to 7726 (which spells SPAM) — most U.S. carriers recognize that number. You can also report it at reportfraud.ftc.gov, which takes about five minutes.
Can my phone get infected just from opening a text or email?
Simply opening a message is very rarely enough on a modern, updated device. The real risk comes from clicking links, downloading attachments, or entering information. Keep your operating system updated — those updates patch the vulnerabilities that make passive attacks possible.