What to do in the moment.
STOP
Do not click. Do not reply. Do not open attachments.
ASK
Was I expecting this? Does it ask for credentials, a code, a payment, or an action? Does it create urgency?
VERIFY
Contact the supposed sender through details you already held.
Never the details in the message.
CHECK THE ADDRESS
Look at the actual sending address, not the display name.
Look at where a link actually goes, without clicking.
IF IT INVOLVES MONEY
Verify by voice, on a known number, without exception.
IF IT ASKS FOR A CODE
It is an attack. No legitimate party asks for one.
IF YOU ALREADY CLICKED
Disconnect the device Change the credentials involved, from a clean device Tell whoever needs to know, immediately
IF YOU ARE UNSURE
Ask someone. Being wrong costs nothing.
REPORT IT
So others are warned.
WHAT NOT TO DO
Delete it quietly and say nothing.
