An unexpected message can look routine: a parcel update, an account notice or a request to confirm a payment. The useful habit is to pause and verify the request through a route you already trust. This guide explains that habit without pretending that appearance alone can identify every scam.
Separate the message from the account
A display name, logo or familiar colour scheme does not prove who sent a message. If it claims to concern an account, open the organisation’s app or use an address you already know rather than the message’s link. Check whether the same request appears there. The point is to verify independently, not to debate whether the design looks convincing.
Read the request carefully
Ask what the sender wants: a password, a code, money, a file download or a conversation elsewhere. An urgent tone is a reason to slow down, not proof on its own of fraud. Look for mismatches between the claimed organisation and the address or destination, but remember that a plausible address does not guarantee safety.
Use the right reporting route
The NCSC publishes guidance on reporting suspicious emails, messages and websites. Its suspicious-email reporting address is report@phishing.gov.uk. Use the official guidance linked below for the correct route and for what to do if you have already responded. Do not send passwords or security codes to this publication.
Keep a simple verification routine
Imagine a message claiming a delivery fee is due. Independently open the courier’s official website or app and check the tracking information you already hold. If the request cannot be verified, avoid making a payment from the message. This is a hypothetical example, not an allegation about a particular courier or a guarantee that any single check will detect every scam.
Questions & answers
Are spelling mistakes the best test?
No. A convincing message can be written well. Independent verification is more useful than relying on style.
What if I have already shared information?
Follow the NCSC’s official response guidance and contact the relevant account provider through a trusted route promptly.
The takeaway
Treat the request as something to verify outside the message. A brief pause and an independent route can make the decision clearer.
Sources & further reading
Public-source references checked for this edition, 12 October 2026. Follow the original source for current information.
Original, AI-assisted explanatory content. The publication byline is not an individual reporter. Examples described as hypothetical are not reported events. Read our editorial policy or report a correction.
