Phishing messages impersonate a person or service to get you to share information or take an action. No single visual clue is a reliable verdict. Focus on verifying the request through a separate channel.
The account suspension warning
- From
- Harbor Bank Security <alerts@harbor-check[dot]example>
- Subject
- Action required: account access ends today
Your account will be paused in 30 minutes. Confirm your password at harborbank[dot]example.account-check[dot]example to keep access.
What to notice
Sender confusion: the display name says “Harbor Bank,” but the address uses a different name. Urgency: the countdown discourages checking. Destination: a brand-like word at the start of a longer address does not identify the owner.
A safer next step
Open the bank’s app yourself. Look for the alert there or call a number from your card or statement.
The small delivery fee
- From
- Parcel Desk <dispatch@parcel-desk[dot]example>
- Subject
- We could not deliver your parcel
Pay a small redelivery fee today. Enter your full card number and billing details at parcel-redelivery[dot]example.
What to notice
A small amount lowers your guard, while the form asks for valuable payment information. A plausible delivery story is not proof that you ordered anything from this sender.
A safer next step
Check your order history and the carrier details supplied by the retailer through a known app or website.
The urgent manager request
- From
- Alex — Team Lead <alex@team-request[dot]example>
- Subject
- Quick favor before my meeting
I cannot take calls right now. Buy gift cards for the team, then send me photos of the codes. Keep this quiet until the surprise.
What to notice
Authority, secrecy, and an excuse to avoid a call work together. Sending the codes transfers the value. A display name or signature does not authenticate your manager.
A safer next step
Use the internal directory to contact your manager. Follow the normal purchase approval process.
The unexpected refund
- From
- BrightDesk Support <refunds@brightdesk-help[dot]example>
- Subject
- Your subscription renewal: refund available
You were charged for a renewal. To cancel, contact this message’s support team and install their remote-assistance tool so they can process the refund.
What to notice
A surprise charge creates alarm. The proposed solution changes from a refund into device access. A caller may show a fake balance or ask for a payment to “correct” it.
A safer next step
Check your actual transaction history independently. Contact the provider through a trusted channel if a charge exists.
Read the address without opening it
Compare the full address with one you already know is official. In the fictional address harborbank.example.account-check.example, the familiar name appears before account-check.example; that does not make it the bank’s website. Subdomains, spelling changes, and look-alike characters can be confusing.
Do not rely only on the visible link text: the actual destination may differ. You do not have to click or preview a suspicious link to investigate. Navigate independently to the service instead.
Polished is not the same as trustworthy
Spelling errors may raise suspicion, but correct spelling does not establish identity. Logos, names, signatures, and an existing conversation can all create a sense of familiarity. A genuine message can also sound urgent, so judge the request and verify it rather than trusting appearance alone.
The FTC phishing guide (opens in a new tab or window) explains common account and payment pretexts and independent verification. The UK NCSC phishing guidance (opens in a new tab or window) explains why education needs to be supported by other defenses.
For the last two examples, see the FTC’s guidance on gift card scams (opens in a new tab or window) and tech support impersonation (opens in a new tab or window).
Already clicked or replied?
Choose the recovery steps for what happened. If you are still deciding whether to respond, use the 30-second scam check. For purchase-related messages, try the shopping website checklist.