Phishing & Suspicious Messages
Learn how to recognize suspicious emails and links, understand phishing, and know what to do after an accidental click.
Is this email legit?
An email may be legitimate, but you should verify the sender and request before trusting it.
Check the sender's full email address instead of relying only on the displayed name. Watch for misspellings, unusual domains, unexpected attachments, urgent requests, and links that don't match the organization mentioned in the message. If you're unsure, don't use the links or phone numbers in the email. Go directly to the company's official website or app and check your account there.
Related guide: How to Spot a Phishing Email Before You Click →
How to spot a phishing email
Look for unexpected requests, suspicious links, unusual sender addresses, and messages designed to make you act quickly.
Phishing emails frequently claim there is a problem with an account, payment, delivery, subscription, or password. The message may tell you that something bad will happen unless you immediately click a link or provide information. Before responding, independently verify the request with the person or company involved.
Related guide: How to Spot a Phishing Email Before You Click →
What to do if I clicked on a phishing link
Close the webpage, don't enter additional information, and take immediate steps to protect your accounts.
If you entered a password, change it through the legitimate website and enable two-factor authentication. If you downloaded a file, run a security scan. Check important accounts for unfamiliar activity. If you entered banking or credit card information, contact the financial institution involved.
Related guide: Think You’ve Been Hacked? What to Do Right Now →
What is phishing?
Phishing is a scam that impersonates a trusted person or organization to steal information or money.
A phishing message might pretend to come from your bank, a delivery company, your employer, a government agency, or a familiar online service. The goal is usually to convince you to reveal a password, financial information, verification code, or other sensitive information—or persuade you to download something dangerous.
Related guide: How to Spot a Phishing Email Before You Click →
How to tell if an email is fake
Check who actually sent the email, where its links lead, and what the message is asking you to do.
Fake emails commonly contain unusual sender addresses, unexpected attachments, spelling errors, urgent warnings, payment problems, fake prizes, or requests for passwords and verification codes. When uncertain, contact the organization separately instead of replying to the suspicious message.
Related guide: How to Spot a Phishing Email Before You Click →
What happens if I click on a phishing link?
Clicking a phishing link can send you to a fake website or expose you to a malicious download, but it doesn't automatically mean you've been hacked.
The greatest risk occurs when you enter login or financial information, verification codes, or download and open malicious software. Close the page, check for unexpected downloads, and review important accounts if you're concerned.
Related guide: Think You’ve Been Hacked? What to Do Right Now →
How to protect yourself from phishing
Slow down, verify unexpected requests, and never give passwords or security codes to someone who contacts you unexpectedly.
Use strong, unique passwords and enable two-factor authentication. Keep your phone and computer updated and be cautious with unexpected links, attachments, QR codes, and login requests. Whenever possible, open the organization's official website or app yourself.
Related guide: How to Spot a Phishing Email Before You Click →
How to check if a link is safe
Examine the destination carefully before clicking and avoid links that don't match the organization you expect.
Look for misspellings, strange domains, extra words, shortened addresses, or unfamiliar website endings. For sensitive accounts such as banking, email, or shopping, the safest approach is often to skip the message link and visit the official website yourself.
Related guide: How to Spot a Phishing Email Before You Click →
Can you get hacked by clicking a link?
Yes, a malicious link can expose you to security threats, but clicking one does not automatically mean your device has been hacked.
Some links lead to fake login pages designed to steal passwords. Others may attempt to download malicious software. If you clicked a suspicious link, close the page, avoid entering information, check for unexpected downloads, update your device, and run a security scan if necessary.
Related guide: Think You’ve Been Hacked? What to Do Right Now →
Scams & Online Fraud
Recognize common warning signs in texts, phone calls, websites, online stores, and other attempts to steal money or information.
How do I know if a text message is a scam?
Be suspicious of unexpected text messages containing links, urgent warnings, payment requests, prizes, or requests for personal information.
Scammers commonly impersonate delivery companies, banks, toll services, government agencies, and familiar businesses. Instead of clicking the link, open the company's official app or website yourself and check whether the message is legitimate.
Related guide:How to Recognize Scam Text Messages
How to tell if a website is fake
Check the website address, company information, prices, policies, and payment methods before trusting an unfamiliar site.
Fake websites often copy legitimate businesses while using slightly different domain names. Other warning signs include extreme discounts, poor-quality content, missing contact information, unusual payment requests, and pressure to buy immediately. Don't assume a website is trustworthy simply because it looks professional.
Related guide:How to Tell if a Website or Online Store Is Legitimate
What should I do if I gave information to a scammer?
Act immediately to protect whichever information or account you exposed.
Change compromised passwords and enable two-factor authentication. Contact your bank or credit card company if financial information was involved. If sensitive identity information was exposed, monitor your credit reports and consider a fraud alert or credit freeze.
Related guide: Think You’ve Been Hacked? What to Do Right Now →
How do I know if an online store is legitimate?
Verify the business before giving it your payment information.
Check the domain name, contact information, return policy, independent reviews, and accepted payment methods. Search for the company's name along with terms such as scam, complaints, and reviews. Be especially cautious when an unfamiliar website offers products at prices dramatically lower than established retailers.
Related guide:How to Tell if a Website or Online Store Is Legitimate
How to recognize a scam phone call
Scam callers often create urgency and demand money, personal information, passwords, or verification codes.
They may impersonate banks, government agencies, technical support departments, family members, or well-known businesses. If you're unsure who is calling, hang up and contact the organization yourself using a trusted phone number.
Related guide:How to Recognize Scam Phone Calls
What information can a scammer get from my phone number?
Your phone number alone usually isn't enough to access your accounts, but scammers may use it to target you or gather additional information.
They may send phishing messages, attempt password-reset scams, impersonate trusted companies, or combine your number with publicly available information. Never provide passwords, authentication codes, Social Security numbers, or financial information simply because a caller knows your phone number.
Related guide:What Can a Scammer Do With Your Phone Number?
How can I tell if someone is trying to scam me?
Unexpected requests for money, passwords, verification codes, gift cards, cryptocurrency, or immediate action are major warning signs.
Scammers frequently create fear, urgency, excitement, or emotional pressure so you act before checking their story. Stop the conversation and independently verify who you're dealing with before sending money or information.
Related guide:How to Tell if Someone Is Trying to Scam You
Hacked Accounts & Devices
Know the warning signs of compromised phones, computers, and email accounts—and the first steps to take if something looks wrong.
How do I know if my phone has been hacked?
Unfamiliar apps, unexpected account activity, strange settings, or unexplained messages can indicate a problem with your phone or accounts.
Other warning signs may include unusual battery or data usage, unexpected pop-ups, login notifications you don't recognize, or messages sent without your knowledge. Not every unusual phone problem means you've been hacked, so investigate before assuming the worst.
Related guide:How to Tell if Your Phone or Computer Has Been Hacked
How do I know if my computer has been hacked?
Look for unexplained programs, account activity, browser changes, disabled security tools, or files that have changed unexpectedly.
Unexpected password-reset notifications, unfamiliar logins, browser redirects, and persistent security warnings should also be investigated. Update your security software, run a malware scan, and check your important online accounts.
Related guide:How to Tell if Your Phone or Computer Has Been Hacked
Can someone hack my phone by texting me?
Receiving a normal text message by itself usually isn't enough to hack your phone.
The bigger danger comes from interacting with the message—clicking malicious links, downloading files, installing unfamiliar apps, or giving the sender passwords and verification codes. Treat unexpected texts containing links or requests for sensitive information cautiously.
Related guide:How to Recognize Scam Text Messages
How do I check if my email has been hacked?
Review your email account's security and login activity for anything you don't recognize.
Look for unfamiliar devices, unexpected password resets, emails you didn't send, changed forwarding rules, missing messages, or recovery information you didn't add. If you find suspicious activity, change your password immediately and enable two-factor authentication.
Related guide: Think You’ve Been Hacked? What to Do Right Now →
What should I do if my email is hacked?
Change your password immediately and secure the account before investigating anything else.
Enable two-factor authentication, sign out unfamiliar sessions, check recovery information, remove suspicious forwarding rules and connected applications, and review your sent and deleted folders. Because email can reset passwords for other accounts, check your banking, shopping, social media, and other important accounts too.
Related guide: Think You’ve Been Hacked? What to Do Right Now →
Device & Account Security Setup
Simple steps for securing Wi-Fi, phones, computers, passwords, and accounts before a problem occurs.
How to secure my Wi-Fi network
Use modern Wi-Fi encryption, a strong password, updated router software, and secure router settings.
Choose WPA3 when available or WPA2 on older compatible equipment. Change default router administration credentials and disable remote administration if you don't need it. A guest network can also help separate visitors and smart-home devices from computers containing sensitive information.
Related guide:How to Secure Your Home Wi-Fi and Router
How to secure my home Wi-Fi router
Start by changing the router's default administrator password and installing available updates.
Use WPA3 or WPA2 encryption, create a strong Wi-Fi password, disable unnecessary remote-management features, and occasionally review which devices are connected. Consider replacing routers that no longer receive manufacturer security updates.
Related guide:How to Secure Your Home Wi-Fi and Router
How to protect my phone from hackers
Keep your phone updated, lock it securely, use two-factor authentication, and install apps only from trusted sources.
Review application permissions, enable device-location and remote-wipe features, and avoid unexpected links and attachments. Never give passwords or authentication codes to someone who contacts you unexpectedly.
Related guide:How to Protect Your Smartphone
How to create a strong password
Use a long, unique password for every important account rather than trying to create one complicated password for everything.
Never reuse important passwords. If one website is breached, a reused password can potentially expose several other accounts. A password manager can generate and store unique passwords so you don't have to remember every one yourself.
Related guide:Passwords and Two-Factor Authentication Made Simple
What is two-factor authentication?
Two-factor authentication adds another security check after your password.
After entering your password, you might approve the login through an authenticator app, passkey, security key, or security code. This makes it substantially harder for someone with a stolen password to access the account.
Related guide:Passwords and Two-Factor Authentication Made Simple
How to set up two-factor authentication
Open the account's security settings and look for two-factor authentication, multi-factor authentication, or sign-in verification.
Follow the provider's instructions to set up an authenticator app, passkey, security key, or another supported verification method. Save any recovery codes somewhere secure in case you lose access to your normal authentication method.
Related guide:Passwords and Two-Factor Authentication Made Simple
How do I make my phone more secure?
Use a strong screen lock, automatic updates, trusted apps, careful permissions, and two-factor authentication.
Turn on your phone's location and remote-wipe features so you have options if the device is lost or stolen. Review privacy settings periodically and be cautious about links received through text messages, email, and social media.
Related guide:How to Protect Your Smartphone
How do I secure a new computer?
Update the computer before using it for important accounts or sensitive information.
Enable automatic updates, the built-in firewall and security protection, a strong login PIN or password, and device encryption where available. Install software only from trusted sources and establish a backup system before storing irreplaceable files.
Related guide:New Device Security Setup Checklist
How do I set up a new phone securely?
Secure a new phone before loading it with personal information and important accounts.
Install current software updates, create a strong screen lock, enable device encryption, automatic updates, device-location services, and remote-wipe capabilities. Review privacy settings and app permissions, install apps only from trusted stores, and enable two-factor authentication on important accounts.
Related guide:New Device Security Setup Checklist
