Do not rely on spelling mistakes. Check whether the request is expected, the sender domain matches, the action makes sense, and the person can confirm it through another channel.
Better warning signs
- Unexpected urgency or secrecy.
- Requests for credentials, codes, gift cards, money, or confidential data.
- A link whose destination does not match the organization.
- An unusual request from a familiar person.
- Resistance to verification through normal procedures.
This page provides general security guidance, not a guarantee that any individual message is safe. When money, passwords, remote access, or sensitive records are involved, verify through a separate trusted channel.