Check without clicking
The common disguises
Parcel delivery problems, "unusual sign-in" warnings, unpaid tolls or fines, tax refunds, subscription renewals, prize draws, and job offers that pay well for easy work. They work because they are plausible: most of us are expecting a parcel or have an account somewhere. AI lets scammers produce endless fresh versions, so recognising the type matters more than remembering a specific message.
Look at where it really came from
The display name can say anything; the actual email address or phone number is harder to fake well. Look for slight misspellings, extra words or odd domains such as "royalmail-redelivery.co" instead of the real site. On a phone, press and hold a link to preview its address without opening it. Even if it looks right, treat it as unverified: addresses can be spoofed.
Never use the link or number in the message
This single habit defeats most phishing. If a message says there is a problem with your account, open the company's app or type its address into your browser yourself, and look there. If the problem is real, it will show up. If you need to call, use the number on your card, bill or the official site, never the one in the message.
Report it, then delete it
Reporting helps take scam sites down. Forward scam texts to 7726 (SPAM), which works with mobile networks in the US and several other countries, and report scam emails through your country's official reporting service; in the US that is the FTC at ReportFraud.ftc.gov. Many email apps also have a "report phishing" button. Then delete it. If you already clicked, lesson 8 covers what to do next.
Which kinds of message do you tend to click without thinking: deliveries, banking, work or social media?