Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Pause before you act. An unexpected message that creates urgency or asks for a password, payment, verification code, or other sensitive information should be treated as suspicious until you verify it through a separate, trusted route. Inspect the sender and destination, but do not treat a familiar logo, official-looking seal, case number, or polished wording as proof that the message is genuine.
Do not use the phone number, link, reply address, or QR code supplied in a suspicious message. Instead, open the organization’s website or app yourself, or call a number from a statement or card you already trust. An unexpected QR code in an email, text, package, poster, or letter is a hidden link: do not scan it merely because the message says you must act immediately.
“If you get an email or a text message that asks you to click on a link or open an attachment, answer this question:” — Federal Trade Commission
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
What phishing is—and why the channel does not make it safe
Phishing is a social-engineering attack that impersonates a company, government agency, coworker, delivery service, bank, or other authority. The sender wants you to reveal credentials or payment information, transfer money, install malware, or provide enough personal data for a later attack. The same scheme can arrive as an email, text message, or QR code; the delivery method changes, but the decision you must make is the same: stop and verify before interacting.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Attackers commonly claim that an account or payment has a problem, a delivery needs attention, suspicious activity was detected, you won a prize, or legal or financial consequences are imminent. They rely on a rushed decision. A message can be grammatically perfect and use accurate branding while still being fraudulent. The FBI’s guidance covers spoofed senders, unsolicited links and attachments, and look-alike destinations, while the FTC specifically warns that QR codes can conceal harmful links (FBI: Spoofing and Phishing; FTC: QR-code scams).
No one channel is inherently safer than the others. An email may carry an attachment, a text may contain a shortened link, and a QR image may hide the destination until your phone opens it. Judge the unexpected contact, its request, and the destination together.
Compare the warning signs by format
| Format | What to inspect | Safest next step |
|---|---|---|
| Sender address, reply-to address, link destination, unexpected attachment, and any request for credentials or payment | Do not click or open anything. Check the claim through a known genuine website, app, or phone number. | |
| Text message | Sender or number, urgency, delivery or payment story, link, and any QR image | Do not reply or follow the link. Forward a suspected phishing text to 7726 (SPAM) in the United States and report it to the FTC. |
| QR code | Whether you expected the code, the destination shown by your scanner, misspellings or look-alike characters, and pressure to scan | Do not scan an unexpected code from a message or unknown source. Verify the supposed request independently. |
The FTC’s text-message guidance is available at How to Recognize and Report Spam Text Messages. The FBI’s QR-code alert also advises against scanning codes from unknown origins, including unsolicited packages (FBI alert, July 31, 2025).
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe pause test: four questions before you touch the message
- Was this contact expected? If you did not recently place an order, open a case, request a password reset, or schedule a payment, an urgent notice about that event deserves extra scrutiny.
- What is it trying to make you do? Requests for passwords, one-time codes, card numbers, bank transfers, gift cards, identity documents, or software installation are high-risk. Legitimate organizations do not need you to surrender a password through an unsolicited link.
- What happens if you wait? Threats such as account closure, arrest, a traffic penalty, lost delivery, or a rapidly expiring prize are pressure tactics. A genuine issue can normally be checked through the organization’s ordinary support channel.
- Can I verify it somewhere else? If the answer is no because the message insists that you use its link or number, stop. Independent verification is the deciding step.
Inspect the sender and the message itself
Check the complete address, not just the display name
Email apps often show a friendly name such as “Payroll” or “Tax Department” while hiding the actual address. Open the sender details and read the domain after the @ sign. Look for extra words, substituted characters, unexpected country-code domains, and misspellings. Check the reply-to address separately when your mail app exposes it. A compromised account can send a message from a real address, so a familiar sender is a clue to investigate, not authentication by itself.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For texts, examine the number, short code, or sender label. A name that appears in a conversation thread can still be spoofed. Do not assume that a local-looking number, a verified-looking badge, or a previous legitimate exchange makes a new request safe.
Read the request as an attacker would
Identify the exact action demanded and the information it would expose. “Confirm your identity,” “unlock your account,” and “avoid a penalty” are not explanations of why a company needs your credentials; they are prompts designed to make you click. Be especially cautious when the message asks you to move a conversation to a new number, download a document, enable macros, install an app, or send a one-time authentication code.
Look for links without opening them
On a computer, hover over a link to reveal its destination; on a phone, press and hold only if your device can show a preview without opening it. Compare the displayed domain with the organization’s genuine domain. Watch for misspellings, added words, hyphens that change the name, subdomains that place the real domain at the end, and URL-shortening services that hide the destination. A padlock or HTTPS connection only describes encryption to the site you reached; it does not prove that the site belongs to the claimed organization.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Treat attachments as a separate risk
Do not open an unexpected invoice, delivery notice, shared document, voicemail, or security report. Malware can arrive in a file even when the accompanying message looks ordinary. Confirm with the supposed sender through a channel you find independently before downloading anything.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not let professionalism overrule evidence
Correct spelling, a legal disclaimer, a case number, a copied signature, or an official-looking seal can be reproduced. These details may be useful context, but none independently authenticates the sender or destination.
How to check a suspicious email safely
- Stop interaction. Do not click, reply, download, call, or scan. If the email is open, leave it open without selecting its content.
- Record the claim. Note which organization is named, what event it describes, what deadline it gives, and what information or payment it requests. This lets you verify the underlying issue without relying on the message.
- Reveal sender details. Expand the header, inspect the full From address and Reply-To address, and compare the domain with the organization’s known domain. Do not judge by the display name.
- Inspect each destination. Hover or preview links and read the complete domain. Treat a mismatch, look-alike spelling, unexplained redirect, or shortened URL as a reason not to use it.
- Assess attachments. If you were not expecting the file, do not open it. Ask the purported sender through a separately obtained contact route whether it is genuine.
- Open a known route yourself. Type the organization’s web address into your browser, use a bookmark you created previously, or open its official app. Sign in only there and look for the same notice.
- Call independently when necessary. Use a number printed on a bank card, statement, contract, or the organization’s genuine website—not the number in the email.
- Delete or report after verification. Once you have confirmed the message is fraudulent, use your mail provider’s phishing-report control and remove it. Preserve relevant details if you need to report a loss or compromise.
How to assess a suspicious text message
Do not reply, even to say “stop”
Replying confirms that your number is active and can invite more messages. Do not follow a link, call the supplied number, or use a QR image embedded in the text. Delivery-fee, account-lockout, toll, parking, traffic-violation, and prize messages are common pretexts for urgent payment requests. The FTC’s April 2026 example describes an official-looking traffic-violation text that directs recipients toward QR-code payment fraud (FTC traffic-violation text alert).
Check the claim outside the conversation
If you really are expecting a delivery or believe an account may need attention, open the provider’s app or type its web address yourself. For a government notice, find the agency’s public contact information independently. A real status or balance should be visible through that normal account, not only through a link in a text.
Recommended Free Tools
Forward and report in the United States
Forward the message to 7726 (SPAM), which helps participating wireless providers identify unwanted texts. You can also report the scam at ReportFraud.ftc.gov. The FTC’s detailed reporting instructions are at How to Recognize and Report Spam Text Messages. Reporting numbers and procedures differ outside the United States, so use your country’s consumer-protection or communications regulator.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to handle a QR code
Why a QR code needs extra caution
A QR image can conceal a web address until your camera or scanning app reads it. The resulting page may imitate a login screen, request card details, install an app, or send you to a payment service. The image itself does not tell you who controls the destination. The FTC warns that scammers place harmful links in QR codes in unexpected messages, and the FBI has warned about codes arriving in unsolicited packages.
Scan only when the context is trustworthy
- Ask why the code is present. If it arrived unexpectedly by email, text, letter, package, or a public notice, do not scan it. Contact the named organization through a known channel first.
- Inspect the physical or digital context. Look for a sticker placed over an original code, altered text, spelling mistakes, or a demand that you act immediately. These are warning signs, not proof by themselves.
- Use the scanner’s destination preview. Let your phone show the URL before opening it, when that feature is available. Read the domain and path; do not rely on the page’s logo after it opens.
- Cancel on any mismatch. Close the preview if the domain is unfamiliar, misspelled, shortened, or unrelated to the organization that supposedly issued the code.
- Navigate independently instead. Type the organization’s address, open its official app, or call a verified number and ask whether the code is required.
If you scanned a code but did not enter information, close the page and do not download anything it offered. If a file or app was installed, disconnect the device from sensitive accounts where practical, update its security software, and run a scan as the FTC advises.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify a request without using the message
Independent verification means starting from information you already trust, not merely opening a second tab from the suspicious message. Use a saved bookmark you created before the incident, manually type the organization’s address, or use its official mobile app. For a call, use a number printed on a card or statement or listed on the organization’s genuine website. Tell the representative what the message claimed, but do not forward a suspicious link or disclose a password or one-time code.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For workplace messages, use a known internal directory, a previously used chat thread, or an in-person confirmation. A request to keep the matter secret, bypass normal approval, or change bank details without a second-person check is a reason to stop and escalate through your organization’s established procedure.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
If you clicked, scanned, replied, or entered information
If you entered a password or authentication code
- Change the exposed password immediately from the genuine site or app, not from the message. If you reused that password elsewhere, change those accounts too, starting with email and financial services.
- Turn on multi-factor authentication. A hardware security key is one possible factor where an account supports it, but it is an account-protection option—not a phishing detector—and support varies by service.
- Review recent sign-ins, recovery addresses, forwarding rules, connected apps, and active sessions. Sign out sessions you do not recognize and remove unauthorized changes.
- Tell your organization’s security team or the service provider that your credentials may have been exposed.
If you supplied payment details or sent money
Contact the bank, card issuer, payment service, or wire-transfer provider using a number from a statement or card. Ask whether a transaction can be stopped, reversed, or monitored. Review statements and account alerts for unfamiliar activity. Do not wait for the suspicious sender to respond.
If personal identity information was exposed
For possible identity theft in the United States, use the FTC’s recovery guidance at IdentityTheft.gov. Follow its steps for reports, account protection, and recovery documents. Requirements and reporting channels differ by country.
If malware may have been installed
Stop using the affected device for banking or sensitive logins until you have updated its security software and run a scan. Remove software you did not intentionally install, apply operating-system and browser updates, and seek professional help if security tools report a persistent infection. Change passwords from a different, trusted device after the device is clean.
Report the attempt
Reporting can help providers identify campaigns and creates a record if money or identity information was involved. In the United States:
- Forward phishing email to reportphishing@apwg.org.
- Report scams and losses at ReportFraud.ftc.gov.
- Forward phishing texts to 7726 (SPAM).
- Report spoofing and phishing to the FBI’s Internet Crime Complaint Center (IC3) through the FBI’s Spoofing and Phishing guidance.
Keep the original message, headers, phone number, destination URL, payment records, and screenshots when a report asks for evidence. Do not keep interacting with the sender while collecting that information.
Practical examples
| Message you receive | Why it is suspicious | Action |
|---|---|---|
| “Your parcel is held. Pay a small fee today through this link.” | You may not have a matching shipment, the deadline creates pressure, and the destination may collect card details. | Open the carrier’s app or type its address yourself and check deliveries there. |
| “Unusual sign-in detected. Confirm your password within 30 minutes.” | The request seeks credentials through an unsolicited link and uses a short deadline. | Use a known bookmark or the official app to review sign-ins and change the password if needed. |
| “Traffic violation: scan this QR code to avoid additional penalties.” | An official-looking notice and QR image combine authority, urgency, and a hidden destination. | Do not scan. Find the relevant authority’s genuine website or phone number independently. |
| “You won a prize; pay a processing fee with gift cards.” | Unexpected winnings and an unusual payment method are classic pressure tactics. | Do not pay or reply. Report the message and delete it. |
Build habits that make phishing less costly
- Use a different, strong password for every important account and store it in a reputable password manager.
- Enable multi-factor authentication, prioritizing email, financial, cloud-storage, and social accounts.
- Keep your operating system, browser, mail app, and security software updated.
- Turn on transaction and sign-in alerts so an unexpected change is visible quickly.
- Make independent verification normal for payment changes, password resets, and requests involving confidential data.
- Teach family and coworkers that urgency is a reason to pause, not a reason to bypass procedure.
These habits reduce the damage when a convincing message arrives, but they do not replace checking the sender and destination. The safest response to an unexpected request remains the same: stop interacting with it, verify through a route you locate yourself, and report it when appropriate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
