How to Check a Suspicious Message Before Clicking

To check a suspicious message, investigate the claimed problem through a channel you open yourself: the service's app, its official address, or a known contact. A sender name and urgency do not establish authenticity.

“Your package is being held. Confirm your details now.” The message arrives just when you are expecting a delivery. It includes a link, seems timely, and asks for one small action. This scenario is fictional, but the decision it raises is familiar: how can you check without following the message's own instructions?

Make the first check outside the message

A familiar sender name, a logo, or polished writing is not enough to confirm who sent a message. If it catches you by surprise and asks for information, pause. Open the app you already use, or type the service's official web address into your browser yourself.

If you need to call, find the contact through an independent channel. Do not rely on a phone number in the alert you are trying to verify. The UK National Cyber Security Centre recommends contacting the organisation directly using details from its official website, rather than details in the message. Read the NCSC advice on checking suspicious messages.

Try it with the package example

Imagine two ways to respond. In the first, you open the link and enter what the page requests. In the second, you check the order in the store where you placed it and look at the tracking information there.

The second route lets you investigate the same concern without depending on the message. You have not decided yet whether it is genuine; you have chosen a more careful way to check.

The US FTC describes texts impersonating delivery services and asking for card details. Its advice is to contact the company using a website or number you know is genuine, instead of the details in the text. This is a delivery-specific example of the same independent check.

A similar-looking domain: read without opening

In this fictional case, Faro Delivery uses farodelivery.example, an address you already knew from your order. The message shows farodelivery.delivery-pending.example. These invented addresses use the reserved ending .example and are shown as text for practice.

1. Separate the address from the claim. “Faro Delivery” and “package held” do not identify the destination. If the address is already visible, you can write it on paper as text; do not paste it into a browser or open it to check.
2. Compare the parts. In the message, the main domain is delivery-pending.example. The initial farodelivery. is a subdomain: that name can be added within someone else's domain. It is not the same as farodelivery.example. Another version, faro-delivery.example, would also be a different domain even though it only adds a hyphen.
3. Return to the order. The difference is enough to avoid that link. Open the known store or app and check tracking and any problem there.

Reading an address cannot certify authenticity or prove a crime on its own. A link's visible text can also hide a different destination. If it is shortened, shown only as a button, or not fully readable, you do not need to uncover it: go straight to the known channel.

Requests that deserve a pause

An unexpected request for a password, verification code, or banking information is a reason to stop and check what is happening. Urgency does not make a request legitimate. The NCSC notes that scammers often use time pressure to push people into acting before they think.

If you already interacted

Stop the conversation and write down what you shared or did. Contact the affected service through its official channels. If you gave out card details or sent money, tell your bank or payment provider as soon as possible. Keep the message and any receipts or confirmations that may help explain what happened.

If you are in the UK, the NCSC provides steps for people who have shared sensitive information after a phishing message. In the US, you can report suspected fraud to the FTC. Elsewhere, look for your country's official cyber-security or consumer-protection service.

For a call that claims there is a problem with your bank account, see how to verify a bank call independently.

NCSC message and incident guidance, and the FTC delivery-text guidance, checked October 7, 2026. Examples are fictional. This is general information, not a guarantee that a scam can be avoided or money recovered.