iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not respond, click, open an attachment, install an app, send money, or share a password or one-time code until you verify the contact through a separate, trusted channel. Inspect the complete sender details, link or domain, and request; then contact the person or organization using a website, phone number, app, or contact record you found independently.
This process works for email, text messages, voice calls, and websites. Caller ID, a familiar logo, a polished page, a display name, an HTTPS padlock, or a message that contains your name can all be forged. Independent verification is the evidence that matters.
The five-step verification workflow
Use these steps in order whenever a message, call, or site creates pressure or asks for access, money, personal information, or a security code. If any step raises a concern, stop and use the recovery instructions later in this guide.
-
Pause before taking the requested action
Do not reply, click a link, open an attachment, download software, scan a QR code, transfer money, buy gift cards, or provide a password, payment detail, or multifactor-authentication (MFA) code. The FBI advises against clicking unsolicited links or attachments and says an MFA code should never be provided through email, SMS, or encrypted messaging.
#1 Best Overall
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
-
Inspect the message or caller details
Expand the sender information and read the complete email address, phone number, or domain. Compare the spelling with the organization or person you expect. Look for urgency, secrecy, threats of arrest or lost benefits, unexpected account “verification,” requests for credentials or financial data, gift cards, cryptocurrency, wire transfers, or other unusual payment methods. Spoofing can alter one character in a sender name, address, telephone number, or URL.
-
Verify through an independent channel
Never use the contact information in the suspicious message. Type the organization’s known website yourself, use a bookmark you created previously, open its official app, or find its number on an independently located contact page. Sign in only through that known service, then call or message the organization or person through the trusted channel. If a familiar person suddenly uses a new number or messaging app, confirm the change through a previously verified platform.
-
Strengthen the account involved
Enable MFA on the affected account and keep its codes private. A physical security key can provide an additional sign-in factor, but it does not prove that an incoming email, text, or call is genuine. Treat every code request as suspicious, even when the sender appears to know details about you.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Report the attempt and recover if necessary
Forward phishing email to reportphishing@apwg.org. Forward suspected phishing texts to SPAM (7726). Report fraud to ReportFraud.ftc.gov and internet crime to the FBI’s IC3. If identity information was exposed, use IdentityTheft.gov. If a click or attachment may have installed malware, update security software, run a scan, remove detected threats, and secure affected accounts.
How to judge the evidence
Not every warning sign proves fraud, and the absence of one does not make a contact safe. Weigh the signals together, giving the greatest weight to an independent confirmation.
| Signal | What it can tell you | How much to trust it |
|---|---|---|
| Known-good contact channel | A person or organization confirms the request through a number, app, bookmark, or website you located independently. | Strongest evidence available in this workflow. |
| Complete sender address or phone number | May reveal a look-alike domain, unexpected country code, or a new number. | Useful, but addresses and caller IDs can be spoofed. |
| Link destination | Shows where a link actually leads rather than what its visible text claims. | Useful for identifying deception; do not visit a suspicious destination. |
| Urgency, threats, secrecy, or payment demands | Indicates social-engineering pressure intended to prevent checking. | Important warning sign, not an absolute proof by itself. |
| Branding, logos, grammar, or visual polish | Can make a message look familiar or professional. | Weak evidence; these details are easy to copy. |
| Caller ID or display name | Identifies what the device displays, not necessarily who initiated the contact. | Weak evidence because both can be forged. |
| HTTPS or a padlock icon | Shows that a connection is encrypted to the displayed site. | Does not establish that the site or operator is legitimate. |
A .gov address alone does not prove that a message is genuine. Grammar mistakes are not required for a scam, and a professional design can be deliberately produced to deceive. Use these details to decide what to investigate, then confirm through a separate route.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Checking a suspicious email
Read the actual sender address
Display names are labels chosen by the sender and can be set to “Your Bank,” a colleague’s name, or a government office. Expand the header or sender line and inspect the full address after the name. Pay attention to extra words, substituted characters, unexpected subdomains, and domains that differ by one letter from the organization’s normal domain. A familiar name paired with an unfamiliar address is not a trusted identity.
Inspect links without following them
On a computer, hover over a link to reveal its destination; on a phone, press and hold only if your mail app safely previews the address. Compare the destination with the visible text. A mismatch, an unfamiliar domain, a misspelling, or a shortened address that conceals the destination is a reason to stop. Do not sign in through the supplied link, even if the page appears to be the company’s normal login screen.
Evaluate the request
Unexpected password resets, account “verification,” invoice changes, payroll updates, wire instructions, gift-card requests, and MFA-code requests deserve independent confirmation. A real organization may send an alert, but you can check the account by opening the known app or typing the known domain yourself. Use a phone number from an official site or an existing contract, not one printed in the email.
Handle attachments safely
Do not open an unexpected document, archive, script, or installer to discover what it contains. Confirm the sender and the reason for the file through a trusted channel first. If you already opened it and a program may have run, disconnect from sensitive services long enough to update security software and perform a scan, then change exposed credentials from a clean device.
Checking a suspicious text message
Assume unexpected delivery, account, toll, and payment texts are unverified
Do not tap the link or reply to ask whether the message is real; a reply confirms that your number is active and keeps you in the scammer’s channel. Open the organization’s official app or type its known domain manually to check for a matching notice. Government agencies generally do not request sensitive information by text.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check number changes through an old channel
If a friend, family member, employee, or supplier suddenly texts from a new number or asks you to move to a new app, contact them using the old number, an established email address, or another platform you already trust. Ask a question that an impostor would not learn from the current conversation, but do not rely on a private question as the only control when money or account access is involved.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Report the text
Forward the complete suspicious message to SPAM (7726). Do not include personal passwords or one-time codes in a reply or report. If you entered information, follow the account-recovery steps in this guide rather than waiting for the report to be processed.
Checking a phone call or voice message
Do not trust caller ID alone
Caller ID can be forged to display a local number, a company switchboard, or a person you know. If the caller demands immediate payment, secrecy, remote computer access, a password, or an MFA code, end the call. A legitimate caller can wait while you verify independently.
Call back using a trusted number
Hang up and use a number saved in your contacts before the call, printed on a card or statement you already possess, or published on the organization’s official website. Do not press a callback option supplied by the caller or use a number found in a voicemail that you have not independently confirmed. For a financial account, call the number on the physical card or the institution’s known app.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAccount for voice cloning
AI-generated voices can sound nearly identical to a legitimate person. Voice recognition is therefore not sufficient for authorizing a transfer, sharing a code, or changing account details. Ask the person to confirm through another channel or use a private question as an additional check, then verify the request with a previously trusted contact method.
Checking a suspicious website
Start from a known address
Type the organization’s address yourself or use a bookmark you created before the incident. Do not use a link from an unsolicited email, text, advertisement, search result that looks unusual, or QR code when the action involves a login or payment. If you are unsure of the address, find the organization’s official contact page independently and follow its navigation to the service.
Read the complete domain
Look at the registrable domain, not only the first words or a logo. Watch for misspellings, inserted words, unexpected hyphens, deceptive subdomains, and a different top-level domain from the one you normally use. A domain can have a valid certificate and still be operated by a criminal.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not mistake encryption for legitimacy
HTTPS encrypts traffic between your browser and the displayed site; it does not verify the site’s ownership, honesty, or safety. Likewise, a polished layout, copied privacy policy, familiar branding, or a padlock icon is not a substitute for reaching the service through a known route. Never enter credentials after following an unsolicited link.
Verify before entering information
For a password reset, payment, tax notice, delivery problem, or benefits message, open the known service separately and look for the alert there. If it is absent, contact the organization through its independently found support channel. Do not test a questionable site by entering “dummy” credentials: that still reveals information and may trigger additional attacks.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you already clicked or responded
If you clicked a link but entered nothing
Close the page and do not download anything it offers. Update the device’s security software and run a full scan. Review recent browser downloads and remove files you do not recognize. If the page prompted a notification, extension, or app installation, revoke that permission or uninstall the unfamiliar software.
If you entered a password
From a clean device, change the password immediately at the service’s known website or official app. Change it anywhere else you reused it, beginning with email because email can reset other accounts. Enable MFA and review active sessions, recovery addresses, forwarding rules, and unfamiliar devices. Do not use a password-reset link from the original message.
If you disclosed an MFA code
Contact the service through its known support channel and say that a one-time code was disclosed. Revoke active sessions, reset the password, replace recovery methods if necessary, and inspect account activity. Never share another code with someone who claims to be helping you secure the account.
If you sent money or financial information
Contact the bank, card issuer, payment service, or payroll department immediately using a trusted number. Ask whether a transfer can be stopped, recalled, or disputed. Preserve the message, transaction details, phone number, email headers, and destination account for the provider and law-enforcement reports.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If identity information was exposed
Use IdentityTheft.gov for a recovery plan. Contact affected institutions, replace compromised credentials or identity documents as appropriate, and monitor statements and account alerts for activity you do not recognize.
If an attachment or app may have installed malware
Stop using the affected device for sensitive logins until security software is updated and a scan is complete. Remove detected threats, update the operating system and applications, and change credentials from a clean device. If the device is managed by an employer or school, notify its security or help-desk team before wiping or reinstalling it.
Reporting and preserving evidence
Reporting does not replace account recovery, but it can help providers identify campaigns and gives investigators useful details. Save the original email when possible, including full headers; keep the complete text thread; record the caller’s number, date, and claims; and preserve suspicious URLs without opening them again. Do not forward sensitive personal information unnecessarily.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Phishing email: forward to reportphishing@apwg.org.
- Phishing text: forward to SPAM (7726).
- Consumer fraud: report at ReportFraud.ftc.gov.
- Internet crime: report to IC3.
- Exposed identity information: use IdentityTheft.gov.
The Federal Trade Commission reported in 2025 that email was the top method scammers used to contact people in 2024. That makes a repeatable email-checking habit valuable, but the same independent-verification rule applies to every channel.
A quick decision checklist
Before you respond or provide information, confirm all of the following:
- You have paused rather than acting under a deadline.
- You know the complete sender address, number, or domain.
- The request is expected and makes sense for this person or organization.
- You inspected links and attachments without opening suspicious content.
- You reached the account or organization through a known website, app, bookmark, or saved number.
- A trusted contact confirmed the request independently when money, access, or identity information is involved.
- You have not shared a password or MFA code.
- You know where to report the attempt and what recovery steps to take if information was exposed.
If you cannot check these items, leave the message unanswered and contact the organization or person through a route you already trust.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
