How to Tell If a Message Is a Scam: A 60-Second Check
A short routine you can run on any text, email, chat or social media message, in any language, to tell whether it is a scam before you click, reply or pay.
You do not need to be a security expert to spot most scams. You need a routine: a few questions you ask every time a message makes you want to act. This check takes about a minute, works on texts, emails, WhatsApp, social media and phone calls, and works in any language.
The 60-second check
1. Was I expecting this? (10 seconds)
Unexpected messages deserve more suspicion. A delivery text when you have not ordered anything, a prize for a competition you never entered, or a "security alert" out of the blue are all classic openers. If you were expecting something, check that the details match what you actually ordered or did.
2. Is it trying to rush or scare me? (10 seconds)
Look for deadlines, threats and excitement: "within 24 hours", "account suspended", "warrant", "you have won", "last chance". Pressure is the most reliable scam signal of all, because it exists to stop you doing exactly what you are doing now: checking.
3. What is it asking me to do? (10 seconds)
Every scam ends with an ask. Be on high alert if the message wants you to:
- click a link and sign in or enter card details
- share a code, password or PIN
- pay, especially by transfer, mobile money, gift card or crypto
- call a number, install an app or open an attachment
- move the conversation to another app
4. Does the sender check out? (15 seconds)
- Email: look at the actual address, not just the display name. Is the part after the @ the organization's real domain?
- Text or chat: is it from an unknown number claiming to be a company, or a "new number" claiming to be someone you know?
- Links: press and hold (or hover) to see the real web address. Does it belong to the organization, or is it a lookalike? See how to check a link without clicking it.
5. Can I check it another way? (15 seconds)
This is the step that settles it. Do not use anything in the message. Instead:
- open the organization's official app, or type its website address yourself
- call the number on your card, bill or the official website
- contact the friend or relative on the number you already have for them
If the issue is real, you will find it there. If not, you have just avoided a scam.
Two or more warning signs? An unexpected message, plus pressure, plus a request for money, codes or details is almost always a scam, whatever it claims to be.
Worked example
- Expected? No. HR does not usually update payroll by WhatsApp from an unknown number.
- Pressure? Yes: "today" and a threat to delay your salary.
- Ask? Bank details and a one-time code, which could be used to take over your account.
- Check another way: contact HR through your usual work channel. You will find there is no update.
Signs that no longer help much
- Spelling and grammar. Many scam messages are now fluent, partly thanks to AI tools. Good writing proves nothing.
- Logos and branding. These are easy to copy.
- Your name or personal details. These often come from data leaks. See how scammers get your number.
- A padlock in the browser. It means the connection is encrypted, not that the site is honest.
What to do with a scam message
- Do not click, reply or call.
- Report it: use "report spam" or "report phishing" in your app. In the UK, forward scam texts to 7726 and emails to report@phishing.gov.uk.
- Delete it.
- If you already clicked, paid or shared something, follow our first-hour checklist.
Want a second opinion in seconds? Paste the message or a screenshot into CyberWatch AI Scan. It is free, and it explains the warning signs it finds.
For the phrases that turn up again and again, see common scam phrases and what they really mean. For every scam type and how to respond, read our guide on how to identify and avoid online scams.
Frequently asked questions
Can a scam message come from a number or address I know?
Yes. Accounts get hacked and sender names can be faked. If a known contact asks for money, codes or clicks in an unusual way, check with them through a different channel.
Is it safe to open a scam message?
Reading a message is generally safe. The danger is in clicking links, opening attachments, replying, calling numbers in it, or following its instructions.
What if I cannot decide?
Treat it as a scam until proven otherwise, and check through the organization's official app, website or phone number. You lose nothing by checking; you can lose a lot by guessing.
Sources
- How to Recognize and Avoid Phishing Scams, US Federal Trade Commission
- Phishing: spot and report scam emails, texts, websites and calls, UK National Cyber Security Centre
- Check if something might be a scam, Citizens Advice
