A message can look like it came from a bank, delivery company or colleague while actually trying to steal information. Urgent language, an unexpected attachment, a mismatched sender address or a request for personal details are reasons to pause.
If you already entered a password, change it from the real service's website and review that account's security activity. If you downloaded a file, avoid opening it and scan the device.
What to do
- Do not open links or attachments, reply, or use an unsubscribe link in the suspicious message.
- If the message claims to be from an organization you use, visit its website by typing the address yourself or using a saved bookmark. Contact it through the details on that website.
- Use your email service's Report phishing or Report spam control. Then delete the message.
If you already entered a password, change it from the real service's website and review that account's security activity. If you downloaded a file, avoid opening it and scan the device.