“Your package is being held. Confirm your details now.” The message arrives just when you are expecting a delivery. It includes a link, seems timely, and asks for one small action. This scenario is fictional, but the decision it raises is familiar: how can you check without following the message's own instructions?
Make the first check outside the message
A familiar sender name, a logo, or polished writing is not enough to confirm who sent a message. If it catches you by surprise and asks for information, pause. Open the app you already use, or type the service's official web address into your browser yourself.
If you need to call, find the contact through an independent channel. Do not rely on a phone number in the alert you are trying to verify. The UK National Cyber Security Centre recommends contacting the organisation directly using details from its official website, rather than details in the message. Read the NCSC advice on checking suspicious messages.
Try it with the package example
Imagine two ways to respond. In the first, you open the link and enter what the page requests. In the second, you check the order in the store where you placed it and look at the tracking information there.
The second route lets you investigate the same concern without depending on the message. You have not decided yet whether it is genuine; you have chosen a more careful way to check.
Requests that deserve a pause
An unexpected request for a password, verification code, or banking information is a reason to stop and check what is happening. Urgency does not make a request legitimate. The NCSC notes that scammers often use time pressure to push people into acting before they think.
If you already interacted
Stop the conversation and write down what you shared or did. Contact the affected service through its official channels. If you gave out card details or sent money, tell your bank or payment provider as soon as possible. Keep the message and any receipts or confirmations that may help explain what happened.
If you are in the UK, the NCSC provides steps for people who have shared sensitive information after a phishing message. In the US, you can report suspected fraud to the FTC. Elsewhere, look for your country's official cyber-security or consumer-protection service.
For a call that claims there is a problem with your bank account, see how to verify a bank call independently.
Official guidance checked September 25, 2026. This is general information, not a guarantee that a scam can be avoided or money recovered.