01. Lookalike identities
Scammers may copy logos, layouts, names, and support language. Visual similarity is not proof of ownership or authenticity. Check the exact domain and verify claims through independent channels.
02. Phishing and urgency
Unexpected messages that demand immediate action, threaten account closure, or request credentials are common warning signs. Avoid opening unexpected attachments or entering passwords through unsolicited links.
03. Security badges are not proof
A page can display labels such as verified, secure, official, or active without any independent validation. Ask who performed the verification, what was checked, when it occurred, and where the evidence can be reviewed.
04. Protect sensitive information
Never disclose passwords, recovery phrases, private keys, one-time codes, or remote-access credentials to unsolicited contacts. Legitimate support should not need your secret authentication material.
05. Report and recover
If you suspect phishing, stop interacting with the page, preserve relevant evidence, change affected credentials through the official service, revoke suspicious sessions, and report the incident to the appropriate provider.
06. A repeatable method for evaluating suspicious messages
- Pause. Urgency, threats, secrecy, and unusual payment requests are pressure tactics.
- Inspect the sender independently. Display names can be spoofed; inspect the full address and verify through a known channel.
- Check the destination. Read the domain carefully, watch for lookalike characters and unexpected redirects, and do not use contact details supplied in the suspicious message.
- Protect credentials. Never share one-time codes, recovery phrases, or passwords in response to unsolicited requests.
- Preserve evidence. Keep message headers, timestamps, and screenshots if reporting is appropriate, but do not forward malicious attachments casually.
07. Common scam patterns
Impersonation often borrows the visual identity of a familiar brand, marketplace, delivery company, bank, or support team. Fake support may ask for remote access; fake account warnings may lead to credential-harvesting pages; investment or escrow claims may pressure victims into irreversible transfers. The design of a page is easy to copy, so appearance is weak evidence of authenticity.
08. If credentials were entered
From a trusted device and a known-good website, change the affected password and any reused passwords. Revoke active sessions where possible, enable multifactor authentication, check recovery methods, and contact the real provider through independently obtained details. If financial data or funds are involved, contact the relevant bank or payment provider promptly. Preserve evidence and report the incident through appropriate local channels.
09. A useful rule
Verify the request using a separate communication path. Do not click the message link and then use the same page to decide whether the message was genuine.
Primary reading: CISA: Recognize and Report Phishing and FTC: Avoid Phishing Scams. Last substantive review: 11 November 2026.