Recognize a scam
Learn the patterns behind suspicious emails, texts, and online shops.
Spot the warning signsFree, practical guides to recognize suspicious messages, protect your accounts, and know what to do if you think you’ve been scammed.
Find the right service for your situation. US reporting options included.
Learn the patterns behind suspicious emails, texts, and online shops.
Spot the warning signsBuild a few useful habits, starting with your email and passwords.
Make a safer startA quick pause before you click, reply, or pay. This checklist helps you decide what to verify; it does not certify that a message is safe.
Practice with example messages →Source: FTC: recognizing and avoiding phishing (opens in a new tab or window).
Separate a simple click from a shared password, download, remote access, or payment.
Read the recovery guideFive fictional messages, with the warning signs explained in everyday language.
Explore the examplesCheck the seller, the deal, and the payment options before you buy.
Use the shopping checklistA login alert can be real or invented. Open the service independently to check your account, instead of following the message.
Compare fictional phishing messages →A browser warning with a phone number can be a tech support trap. Don’t grant remote access to an unexpected caller.
FTC: tech support scams → (opens in a new tab or window)A countdown does not prove demand. Check the merchant and payment method before a discount pulls you into checkout.
Check a shopping website →An impersonator may claim to be a relative or colleague. Call the person through a number you already have before sending money.
FTC: fake emergency requests → (opens in a new tab or window)Use a password manager to create and store long, unique passwords. Start with email, which often receives account reset links.
Turn on multi-factor authentication (MFA) where offered. Never share a one-time login code or approve an unexpected sign-in request. MFA reduces risk; it is not a guarantee.
Enable automatic updates for your device, browser, and apps. Install updates through built-in settings or the publisher’s official site.
Keep recovery details current and backup codes somewhere secure. Back up important files so you have another copy.
Source: CISA: cybersecurity awareness basics (opens in a new tab or window).
Source: FTC: why protecting your email matters (opens in a new tab or window).
Focus on what someone wants you to do, rather than trying to recognize every new scam name.
Good spelling, a familiar face, or an authentic-looking logo is not proof. Verify an unexpected request through a separate, trusted channel, especially if it asks for money or login information.
FTC: verify the request independently → (opens in a new tab or window)Texts and QR codes can lead to unfamiliar websites. Don’t install an app because a delivery text tells you to. Use your device’s settings to review updates and app permissions.
UK NCSC: suspicious parcel texts and apps → (opens in a new tab or window)Safety guidance links to the organizations behind it. Third-party learning picks are labeled by format and level.
Read our editorial approach →