A suspicious email often arrives in the middle of something else. The difficult moment is the request to act: open a document, fix a payment, or sign in before a deadline. Having a short response process ready is more practical than trying to remember a long list of visual clues under pressure.
The process below is designed for ordinary account messages and workplace email. For a managed work account, use your organization’s reporting and incident procedures.
Read the requested action before deciding
Identify what the message wants you to do. Is it asking for money, account access, personal information, or a file download? The FTC describes phishing messages as attempts to obtain sensitive information or lead people to harmful links and attachments.
Write the request in plain language if it helps: “change the payment destination” or “enter my password through this link.” That makes the decision more concrete than judging whether the message looks professional.
Check whether the request fits something you were expecting, but do not treat familiarity alone as proof. NIST notes that phishing can appear to come from a trusted business or a leader within your own organization.
Pause instead of following the supplied route
A deadline in the message does not establish that its instructions are genuine. NIST identifies urgency and requests for sensitive information as warning signs. Treat a mismatch in the sender address as a reason to investigate; a familiar display name does not complete that investigation.
For a message you suspect is phishing, avoid its links, attachments, reply route, and unsubscribe link. Do not open an unexpected document merely to decide whether it is important.
- Leave the requested account or payment change unfinished.
- Keep the service or colleague’s name in mind for an independent check.
- Use the reporting tool or contact your designated support person when appropriate.
- Do not forward the message to coworkers as an ordinary task to complete.
Verify through contact details you already trust
The FTC recommends contacting a person or organization using a phone number or website known to be real, rather than the information supplied in the suspicious message. You can open a service’s official app or use your established bookmark to check for a genuine account notice.
Consider an invented example: a message claims a supplier has changed bank details before an invoice is paid. The safe administrative step is to verify the requested change through the established contact and your normal approval process. A reply within the same unexpected email chain does not provide an independent check.
If you cannot verify the request, keep it unresolved and seek help. There is no need to invent an explanation or classify every unfamiliar message as definitely fraudulent.
Make reporting a clear next action
Find out where your email service places its phishing-report option, or where your employer wants reports sent. Do this before you need it. Follow that process and any instructions about preserving the original message.
For a household, a short reminder beside the computer might name the trusted route for contacting a bank or service. For a workplace, a clear reporting contact can reduce confusion about who handles an unusual request.
After reporting, follow the relevant guidance for removing the message from the inbox. Avoid circulating clickable suspicious material in a general group chat as a warning.
If you already interacted, report the details promptly
Record what happened: whether you clicked a link, opened a file, entered a password, or supplied payment information. Do not include passwords or verification codes in the report itself. For a work device or account, notify the responsible support or security team promptly.
NIST advises changing affected passwords and contacting the financial institution when an account there has been compromised. Use trusted routes and the appropriate incident guidance; the required response depends on what was exposed. Simply deleting the original email does not address an account or device that may already be affected.
Keep a brief record of the report and any instructions received. This helps the person assisting you work from concrete facts instead of trying to reconstruct the sequence later.