46 Networks · Free technology lesson
Suspicious email? Check before clicking
Pause, verify through a separate trusted route, and report suspicious messages.
About two minutes. Computer-generated narration. The key instructions are also written below.
1. Look beyond the name and logo
Expand the sender details to see the full address. A familiar name or polished writing does not prove a message is genuine. Unexpected attachments, urgent demands and requests for secrets deserve extra care.
2. Use a separate trusted route
Open the company app yourself or type a website address you already know. For a phone check, use a trusted number from an earlier statement, not the number in the suspicious message.
3. Protect passwords and sign-in codes
Do not reply with a password or a one-time sign-in code. For a work account, follow your organization’s reporting process. For personal email, use the provider’s phishing or spam reporting option.
4. Act if you already responded
Close an unexpected page. If you entered a password, change it promptly through the genuine site or app, including anywhere you reused it. If you installed software or sent money, seek trusted help immediately.
Further reading: NIST: Phishing.