An unexpected message: what should you check?

A delivery notice you were not expecting. A payment request that feels unusual. Before responding, give yourself time to work through these questions.

1. Were you expecting it?

Think about whether you know the sender or were waiting for this request. A familiar name or logo alone does not prove a message is genuine. Scammers can copy an organization’s appearance or use a lookalike address.

The FBI explains how spoofing and phishing work.

2. Is it putting you under pressure?

Be cautious when a message demands immediate action, threatens trouble, or pushes you to pay before you can check the story. Pause and talk to someone you trust instead of letting the deadline make the decision for you.

See the FTC’s common scam warning signs.

3. What is it asking you to share or do?

Notice requests for passwords, account details, personal information, money, links, or attachments. Do not click an unexpected link or open an unfamiliar attachment just to find out whether it is safe.

Check through a separate, trusted channel.

If a message claims to be from a company you use, contact that company through a phone number or website you already know is genuine. Use that route to ask about the request, rather than the contact details inside the message.

The FTC’s phishing guide explains how to recognize, avoid, and report these messages.