Messages designed to manipulate.
WHAT THEY ASK FOR
Credentials A payment A code
An action: opening a file, approving a request
WHAT THEY CLAIM
An account problem A failed payment or delivery An urgent instruction An opportunity
WHAT NO LONGER IDENTIFIES THEM
Poor spelling and grammar. Those are gone.
WHAT DOES
The request itself.
Legitimate organisations do not ask for passwords or codes.
THE CODE POINT
A verification code is for you alone.
Anyone asking for it is attempting to take your account, regardless of who they claim to be.
WHAT TO DO WITH ANY MESSAGE ABOUT AN ACCOUNT
Do not use its links.
Go to the site the way you normally do.
That single habit defeats most of these.
WHAT TO DO WITH AN UNEXPECTED ATTACHMENT
Do not open it. Verify with the sender through a separate channel.
WHAT TO DO IF YOU ARE UNSURE
Ask someone. Being wrong is fine; acting is not.
