How to Tell If an Email, Text, or QR Code Is a Phishing Scam

Overview

Phishing is an attempt to trick you into revealing information, installing harmful software, transferring money, or signing in through a fraudulent page. The message may arrive by email, SMS, a messaging app, or a QR code placed on a poster, package, parking meter, or printed notice. “Smishing” is the same general tactic delivered by text message.

A convincing message does not prove that it is legitimate. Scammers can copy logos, use familiar language, spoof display names, and create websites that look almost identical to the real service. Instead of judging a message by appearance, evaluate its request, timing, destination, and pressure tactics.

The safest general rule is simple: do not use the contact details or links supplied by a suspicious message. Open the official app yourself, type a known website address into your browser, or use a phone number from a statement, card, contract, or official contact page. For a broader domain and website review, see How to Check If a Website Is Safe Before You Click, Sign In, or Pay.

Checklist by scenario

Email phishing

• Inspect the sender address. A familiar display name can hide an unrelated address. Look beyond the name and check the domain carefully for extra words, substitutions, or misspellings.
• Read the request precisely. Be cautious if the email asks you to confirm a password, payment detail, tax document, gift card purchase, security code, or wire transfer.
• Hover before clicking. On a computer, place the pointer over a link without opening it. If the destination does not match the organization or leads through an unexpected domain, treat it as a malicious link warning.
• Question unexpected attachments. An invoice, shared document, voicemail notice, or delivery label can be used to encourage a dangerous download. Verify the file through a separate channel.
• Do not trust urgency. Claims that an account will close immediately, a payment failed, or a manager needs secrecy are common pressure techniques.

Common email scam examples include fake password-reset notices, payment-failure alerts, payroll requests, account-verification messages, and shared-file notifications. A legitimate organization may contact you, but you can still verify the request independently before acting.

Text messages and smishing

• Be skeptical of unexpected links. Short links and unfamiliar domains conceal the destination. Do not tap a link merely because the text mentions your name, a recent purchase, or a recognizable company.
• Check whether the message fits your activity. A delivery text for an order you did not place, a toll notice for a trip you did not take, or an account alert for a service you do not use is a strong warning sign.
• Never share a one-time code in response to an unsolicited message. A code can be used to approve a login or reset an account. If someone asks you to read it back, stop and verify through the official app or website.
• Do not reply to “STOP” as your first response to a suspicious sender. Use your phone’s report-junk or block feature when available, and contact the organization independently if the message might relate to a real account.

For a text scam alert involving a package, compare the message with your order history and access the carrier’s site directly. The guide to package delivery scams and common tactics can help you review that scenario without using the message’s link.

QR code scams

A QR code can hide the same destination as a clickable link. Before scanning, consider where the code came from and whether a sticker appears to have been placed over an original code. After scanning, pause before opening the result.

• Check the displayed web address before continuing.
• Look for a domain that matches the expected organization, not merely a familiar logo or page design.
• Be especially cautious if the page requests a password, card number, identity document, or payment for an unexpected reason.
• Do not install an app from a QR code unless you have independently confirmed the app and reached it through a trusted app store or official site.

A QR code scam warning deserves the same attention as a suspicious email: the code is only a delivery method, not evidence of trust.

Fake account, payment, and delivery alerts

When a message claims that an account, payment, subscription, or shipment needs attention, start outside the message. Open the relevant service using a bookmark you created earlier, the official mobile app, or a website address you enter yourself. Check for the alleged problem there. Do not sign in through the message and then use that session to investigate.

What to double-check

1. Pause. Do not click, reply, scan, download, or call while the message is creating urgency.
2. Identify the claimed organization. Write down who the sender says it is, what it wants, and what consequence it threatens.
3. Verify through a separate route. Use an independently located website, app, statement, or phone number. Never rely on the contact information in the suspicious message.
4. Inspect the destination. Check the full domain, spelling, and whether the page is asking for more information than the task reasonably requires.
5. Confirm with a real person when needed. For a workplace request, contact the colleague through an established channel. For a family or friend request, call a number already saved in your contacts.
6. Report and remove it. Use your email provider’s phishing-report option or your phone’s junk-reporting feature, then delete the message. Reporting helps your systems recognize similar messages, but it does not replace verification.

If you entered a password, approved a login, downloaded a file, or shared financial information, act promptly. Change the exposed password from a trusted device, sign out other sessions, enable multifactor authentication, and contact the relevant bank or service through an official channel. For a fuller response plan, read How to Recover After Phishing.

Common mistakes

• Trusting branding. Logos, colors, signatures, and polished layouts are easy to copy.
• Checking only the first part of a URL. The important domain is usually near the end of the main web address, not a brand name buried in a long subdomain or path.
• Assuming HTTPS means the site is legitimate. Encryption protects the connection; it does not prove who operates the site.
• Using search results without checking the destination. Search for the organization, then confirm that you are on its official domain before signing in.
• Calling the number in the message. A phone conversation can still be fraudulent if the number was supplied by the attacker.
• Forwarding a suspicious message without context. If you warn someone, describe the risk and tell them not to use the included links or attachments.

When to revisit

Use this checklist whenever a message asks for credentials, money, personal information, software installation, or urgent action. Revisit it before seasonal shopping periods, tax or benefits deadlines, travel, major account changes, and workplace planning cycles, when people may be more accustomed to legitimate notifications.

Update your personal process whenever your bank, employer, email provider, password manager, or phone changes its login and alert workflow. Review blocked senders, multifactor authentication, recovery email addresses, and notification settings at the same time. Website owners and marketing teams should also review links in automated campaigns, QR codes in printed materials, and third-party forms so that legitimate messages are easier for recipients to verify.

Before acting on the next unexpected message: pause, identify the request, avoid its links and contact details, open the official service independently, verify the issue there, and report the message if it is fraudulent. That short routine is more reliable than trying to memorize every new phishing format.