Test the claim on a separate channel
The message can tell you what is being claimed, but it cannot be the only proof that the claim is real.
What is the claim?
State the request in plain words: sign in, pay, share a code, open a file, or call a number.
Who can confirm it?
Find the organization through a saved app, statement, contract, or address you already know.
Where should action happen?
Use the real account or known contact. Do not return to the supplied link to complete the task.
Break the message into a claim and a requested action. The claim might concern an account, invoice, delivery, refund, job, or family emergency. The action might be a login, payment, download, reply, or disclosure of a code. Writing both in plain language makes urgency and unusual requests easier to see.
Verification must start somewhere the message did not supply. Open the known app, type a saved address, use a statement, or call a number already held in your records. Do not paste a suspicious link into a search box or call the number shown by caller ID. If you already acted, switch from verification to containment through the affected provider's official recovery process.
- State what the sender claims and what they want.
- Verify through a separately obtained channel.
- Preserve useful evidence without forwarding sensitive material widely.
Invoice example
An email says an invoice is overdue and links to a new payment portal. Instead of replying, the recipient opens the vendor record already stored in the accounting system and calls the known number. The vendor confirms its mailbox was compromised.
Phishing verification checklist
Pause the message and work through these checks without clicking, replying, or calling a number supplied in the request.
Why separate-channel verification works
- A polished logo and correct personal detail do not prove authenticity.
- Legitimate organizations can have compromised accounts, so a familiar sender is not enough when the request is unusual.
- Multifactor authentication reduces account-takeover risk even when a password is exposed.
Evidence basis: The cited sources support the checks above. They do not replace current provider, property, workplace, authority, or local requirements. Federal Trade Commission: How to Avoid a Scam and CISA: Secure Our World.
Provider and reporting limits
A familiar sender, logo, or personal detail is not proof. Providers have different reporting and recovery routes, so start from the real account or a contact you already know rather than the message itself.