Updated November 5, 2026

The scam email checklist

Scammers change their stories, but their tricks stay the same. Learn the tricks and you can spot new stories too.

Examples only. These are common patterns, not a full list. A message that does not match any of them can still be a scam.

Step 1: Ask one question first

The FTC suggests asking: Do I have an account with this company, or do I know this person? If the answer is no, it is likely phishing. If the answer is yes, still check by contacting them a way you already know. (FTC)

Step 2: Check the five warning signs

Check	What to look for	Quick test
Sender	Name and email address do not match. Extra letters or numbers. A free email account for a "company."	Tap or click the sender name to see the full address.
Links	The web address is not the company's real site, or it has extra words, like `bank-login-help.com`.	Hover (computer) or press and hold (phone). Do not tap.
Urgency	Deadlines, threats, "final notice," account "locked."	Slow down. Real problems can wait 10 minutes.
Money ask	Gift cards, wire, crypto, payment apps, or a "refund" you must pay to get.	If they want an odd way to pay, stop.
Writing	Generic greeting, odd wording, attachments you did not ask for.	Compare with a real email you got from them before.

Step 3: Know the common patterns

Fake IRS or tax messages

Messages say you owe tax, have a refund waiting, or must "verify" your identity, often with a link. The IRS has a page on how to recognize tax scams and how to report fake IRS emails and texts.

Made-up exampleIRS Notice: You are eligible for a tax refund of $1,240. Verify your identity here within 48 hours.

Package delivery texts

A text says a package cannot be delivered and asks you to click a link to "reschedule" or pay a small fee. The U.S. Postal Inspection Service explains these package tracking text scams: USPIS on smishing.

Made-up exampleUSPS: Your package is on hold due to an incomplete address. Update now: usps-redelivery-help.top

Bank or account password reset

An email says someone tried to log in, or your password must be reset, and gives you a link. The FTC lists "suspicious activity or log-in attempts" and "a problem with your account" as common phishing stories. (FTC)

Made-up exampleWe noticed an unusual sign-in. If this was not you, reset your password now using the link below.

Safe move: do not use the link. Open your bank's app or type its web address yourself, and check there.

"Boss" or "family member" in trouble

A message that seems to come from your boss or a relative asks for gift cards or a quick money transfer, and asks you to keep it quiet. Call them on a number you already have.

Step 4: Report it

Report scams to the FTC at ReportFraud.ftc.gov.
The FTC also says you can forward phishing emails to [email protected] and forward scam texts to 7726 (SPAM). (FTC alert)
If you lost money online, you can also file with the FBI's Internet Crime Complaint Center (IC3).
Then delete the message.

If you already clicked

Do not panic. Change the password on that account (from the real site), turn on two-step login, and follow our after-a-breach steps. If you shared your Social Security or bank number, go to IdentityTheft.gov for a recovery plan.

General information only. Not legal, financial, or security advice, and not a guarantee. Check with the company or agency involved.

Sources we used

Links checked November 5, 2026. If a page moved, search the agency site for the title.