Check a suspicious message without following its sign-in link
Separate the message’s claim from its link, verify through the official service and respond according to what you actually exposed.
In brief
A phishing message tries to make you sign in, pay, open a file or grant access under a false pretext. The safest check is to open the service independently and see whether the claimed event exists there.
You do not need to decide from grammar or a familiar logo alone; real accounts and convincing templates can be abused.
Check the claim, not the decoration
For an account warning, inspect the official account’s security activity. For an invoice, confirm with the sender through a number or channel you already know. Do not reply to the suspicious message asking whether it is genuine; you may be asking the attacker.
Inspect without rewarding the link
If you inspect a destination, read the hostname rather than the familiar word elsewhere in the URL. Avoid forwarding the live link widely or opening it to “see what happens.” A copied link can contain personal tokens, so do not submit it to a public checker without inspecting that exposure.
Respond to the actual exposure
If you entered credentials, change the affected or reused password from a trusted device and review sessions and recovery settings. If you installed software or granted remote access, isolate the device and seek appropriate security help. If payment information was exposed, contact the provider through its official channel promptly.
Before you act
A padlock confirms an encrypted connection, not an honest business. Clicking, entering a password and running a downloaded file are different exposures and need different responses.
What to do next
- Do not open the attachment or use the message’s login link.
- Open the official app or a known saved address and check the claim there.
- Report the message through the service or mailbox and take recovery steps if you entered data or ran something.
