Urgency is not evidence
CISA describes phishing as an attempt to make you open a harmful attachment or share personal information. Its guidance recommends recognizing, reporting and deleting suspicious messages. [1] The practical difficulty is that a message may seem timely: perhaps you are waiting for a parcel or have just signed in.
Instead of deciding from appearance, separate two questions: is the story plausible, and have I verified who is requesting the action? A positive answer to the first does not resolve the second. An attacker does not need to know all your movements to coincide with a common activity.
Check the request through another route
For an account alert, open your usual application or type an address you already know. Look for the notification there. For a request from a person, use a previously verified number or conversation, not the contact details supplied in the questionable message.
This prevents the message from controlling both the story and the verification route. You do not need to open a suspicious link to prove it false. If the alert does not appear in the service, consult support through an official channel before acting.
| The message says… | Check it this way |
|---|---|
| “Your parcel is being held” | Review the order and tracking through the store or a known application. |
| “Your account will close” | Open the service through your usual route and check notifications. |
| “I need you to pay now” | Confirm with the person using contact details you already had. |
Which signals help, and which are insufficient?
Review the full sender address and link domain without opening the link, if your device can display it safely. An unusual address is a useful signal, but an apparently correct one does not resolve every case. Do not share verification codes or approve sign-in requests you did not initiate.
Good spelling and professional design do not establish identity. Similarly, HTTPS protects the connection’s transport, but does not prove the website owner is who they claim to be. Use these clues as reasons to investigate, not as an automatic test that declares a message safe.
If you have already interacted
Distinguish what happened: opening a message, downloading a file, running a program and entering credentials are different situations. If you entered a password on a suspicious page, access the real service from a trusted device and change it; review sessions and recovery methods. Also change it on any other account where it was reused.
If you ran a file or are using a work device, ask the security team for help and explain exactly what happened. If a payment or bank details are involved, contact your institution through its official channel. Retain information needed to report the incident without forwarding dangerous attachments to others.
CISA also recommends strong passwords, a password manager and multifactor authentication as general protective measures. [2] Our proposed addition is a simple habit: when faced with an unexpected request, pause and verify through an independent route.
Example: a delivery notice requesting a small payment
A message uses your name and claims a small fee is required to deliver a package. Knowing your name or matching the delivery company does not establish authenticity. Do not use its link to check.
- Open the company's official app or website independently.
- Find the shipment using your original purchase reference rather than information from the suspicious message.
- If details do not match, contact the company using its official website.
- If a friend sent it, verify through another channel: their account may be compromised.
If you entered a password, change it through the official service, review active sessions and recovery methods, and change it elsewhere if reused. If you supplied payment details, contact your financial institution through a known channel. Keeping the message may help reporting; forwarding it so others open it adds risk.
Sources and documentation
Sources consulted on October 7, 2026. Original documentation; linked sources may be in English.
