Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A message that appears to come from your bank, boss, supplier, or a familiar phone number is not proof that it really did. Attackers can disguise who is contacting you, take over a real account, or send you to a convincing fake website. Before sending money, sharing a password or one-time code, or changing account details, verify the request through a separate contact route you already trust.
How attackers borrow trust
Trusted-channel scams exploit the familiarity of everyday communication: email, text messages, phone calls, caller ID, and websites. The attacker’s goal may be to steal login credentials or MFA codes, redirect a payment, obtain sensitive information, or persuade someone to act before checking.
- Impersonated sender or caller: A message may use a familiar person’s name, a lookalike address, a misleading phone number, or a fraudulent website. The FBI describes spoofing as disguising identifying information such as an email address, sender name, phone number, or URL.
- Compromised account: A criminal who has access to a genuine mailbox may send a request from it or insert a fraudulent payment change into an existing conversation. A real account and an authentic-looking thread can still be under an attacker’s control.
- Fake financial-institution support: Someone posing as bank or account support may try to obtain credentials or a one-time passcode, or steer a victim to a fraudulent sign-in page. In a 2025 alert about account-takeover fraud involving impersonation of financial-institution support, the FBI’s Internet Crime Complaint Center reported more than 5,100 complaints and losses exceeding $262 million since January 2025. Those figures describe that alert’s account-takeover category and timeframe, not all trusted-channel scams.
- Business Email Compromise (BEC): A message that appears to come from a known source may request a legitimate-seeming action, such as paying an invoice. The FBI also calls this email account compromise (EAC); some cases involve spoofing, while others use a compromised account.
The request itself is often more revealing than the sender display name. Treat unexpected urgency, new payment instructions, gift-card requests, password or account-verification prompts, and requests for MFA codes as reasons to stop and verify independently.
Spoofing and account compromise are different
| Pattern | What is happening | What to keep in mind |
|---|---|---|
| Spoofing | The sender name, address, caller ID, or website is made to look like a trusted one. | A familiar-looking identity does not establish who sent the communication. |
| Account compromise | An attacker has access to a genuine account, such as an email mailbox, and can use it to contact people or alter a conversation. | A message may come from a real account and still be fraudulent. |
These tactics can overlap, but they are not interchangeable. A suspicious message does not prove that the person or business whose name appears on it has been hacked. Conversely, an email that arrives in a genuine ongoing thread should not be trusted automatically if it introduces an unusual request.
#1 Best Overall
How to check a message from a bank, colleague, or supplier
- Pause before acting. Do not click the supplied login link, reply with sensitive information, send a code, or approve a payment while the request is unverified.
- Use a separate, known route. Open the service through a bookmark or an address you already know, or contact the person using a number or address you had on file before the message arrived. Do not use contact details or sign-in links supplied in the suspicious communication.
- Confirm the specific request. Ask whether the person initiated it and verify the exact amount, recipient, account change, or requested action. For an account alert, check the account directly rather than following a message link.
- For a call, hang up and call back independently. Caller ID is not independent proof of identity. Find the organization’s number through a trusted source or use the number already on your account.
- Report suspicious contact through a known route. Use the organization’s established reporting process or contact its support team through its official site, reached independently.
Do not provide a password, MFA code, or one-time passcode simply because a caller or message claims to be support. A fraudulent sign-in page can capture credentials even if an account has MFA enabled; MFA is not a reason to trust a link.
What businesses should do before changing payment details
Small businesses are particularly exposed when a request arrives during a real invoice or supplier conversation. The safest payment procedure makes verification routine rather than dependent on whether a message looks convincing.
- Pause the change. Do not update vendor banking details or release a payment solely on the basis of an email, text, or call.
- Contact the requester using existing records. Call a number already on file or use another established contact route—not a new number or link included with the change request.
- Verify the exact details. Confirm the beneficiary and account information, the amount, and the reason for the change. Record who confirmed it and when, in line with the business’s procedure.
- Require a second check for high-risk changes. Have another authorized person review the change or payment under the organization’s approval process.
- Give employees a clear reporting route. Staff should know where to forward suspicious messages and whom to contact when they receive a payment, credential, or code request.
These checks still matter when a message appears in an existing thread: an attacker may have access to a genuine mailbox. A separate callback or established second channel helps verify the request itself, not merely the address it came from.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhich security controls address which risks?
No single control covers every trusted channel. Email authentication helps with domain spoofing; sign-in protections help defend accounts; staff procedures help catch requests that technology cannot validate.
| Control | What it helps with | What it does not establish |
|---|---|---|
| SPF | Identifies mail servers authorized to send for a domain. | It does not prove that an individual request is legitimate or stop a scam call. |
| DKIM | Uses a digital signature to help validate email from a domain. | It does not make a compromised legitimate mailbox safe. |
| DMARC | Checks alignment with the visible From address and lets the domain owner specify how unauthenticated mail should be handled. | It does not prevent account takeover or impersonation through other channels. |
| MFA | Adds a sign-in factor beyond a password. A phishing-resistant factor, such as a hardware security key, may be an option where the service and device support it. | It does not make a fraudulent login page safe or replace independent verification. |
| Callback and approval procedures | Help staff verify payment changes and unusual requests over an established separate route. | They depend on using contact details and approval rules that were set up before the suspicious request. |
FTC guidance cautions that email-authentication settings need careful configuration because mistakes can disrupt legitimate mail. Businesses should configure SPF, DKIM, and DMARC for their domains and account for legitimate sending systems before changing enforcement settings. Combine these technical measures with MFA, employee training, and clear reporting and callback procedures.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if someone acted on a suspicious request
If money was sent
- Contact the sending financial institution immediately and explain that the transfer may be fraudulent.
- Ask the institution to contact the receiving institution. Do not wait for the recipient or apparent sender to respond.
- Preserve the message, payment instructions, transaction details, and relevant account information for the bank and reporting process.
If credentials or an MFA code were shared
Use the service’s official site or app, reached independently, to secure the account and follow its account-recovery and security instructions. If the same password is used elsewhere, change it on those accounts too; unique passwords reduce the harm from a stolen credential. Report the incident through the service’s known support route.
If a business is being impersonated
Follow the business’s incident procedures, report the incident to appropriate authorities, and warn affected customers promptly. The FTC advises businesses that discover impersonation to tell customers as soon as possible. Send warnings through a channel customers can recognize, avoid hyperlinks in warning emails, and explain how customers can independently reach the business.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Reduce the chance of a repeat
- Use unique passwords and enable MFA wherever it is available.
- For email domains, maintain SPF, DKIM, and DMARC with a configuration that accounts for legitimate mail sources.
- Train staff to report urgent requests involving money, credentials, account changes, or codes, and make the reporting route easy to find.
- Set and follow a callback procedure for payment changes, using contact information already on file.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
