How to Spot a Scam Email, Text, or Phone Call

Learn the telltale signs of phishing emails, scam texts, and fraud calls so you never fall for one.

5 min read · 8 steps · Checked April 2026

1. Step 1. Know what scams look like in 2026

   Scammers are getting more clever every year. Here are the most common scams happening right now:

   • Unclaimed funds calls — Callers say the government owes you money and you need to pay a "processing fee" to get it. The FTC issued a major alert about this in March 2026.
   • Fake delivery notifications — Texts claiming your package could not be delivered, with a link to "reschedule." The link steals your information.
   • AI voice scams — Scammers use artificial intelligence to clone a family member's voice and call you pretending to be them, usually saying they are in trouble and need money urgently.
   • Fake tech support calls — Someone calls claiming to be from Microsoft, Apple, or your internet provider saying your computer has a virus.
   • FIFA World Cup ticket scams — With the 2026 World Cup, fake ticket websites and "too good to be true" offers are everywhere.

   Knowing what to look for is your best defense.

   Quick Tip

   In 2026, scammers are using AI to clone voices of your family members. If you get a call from a loved one asking for money urgently, hang up and call them back on their real number.

2. Step 2. Check the sender carefully

   One of the easiest ways to spot a scam email is to look at who actually sent it. Scammers often use email addresses that look almost right, but are slightly off. For example:

   • Real: support@amazon.com
   • Fake: support@amaz0n-orders.com (zero instead of the letter "o")
   • Real: noreply@paypal.com
   • Fake: noreply@paypa1-secure.com (number "1" instead of letter "l")

   Always check the full email address, not just the name shown. On your phone, tap the sender's name to reveal the actual address.

3. Step 3. Watch for urgency and threats

   Scammers want you to act fast — before you have time to think. Watch for messages like:

   • "Your account will be closed in 24 hours!"
   • "Urgent: unauthorized activity on your account"
   • "You must pay right away or face arrest"
   • "Act now — this offer expires today!"

   Real companies do not threaten you via email or text. If something feels urgent and scary, that is a big red flag.

   Warning

   The IRS, Social Security Administration, and Medicare will NEVER call you threatening arrest or demanding immediate payment. That is always a scam.

4. Step 4. Do not click links — check them first

   Before clicking any link in an email or text, check where it actually goes:

   • On a computer: hover your mouse over the link (do not click). Look at the bottom-left corner of your browser — the real web address will appear there.
   • On a phone: press and hold the link (do not tap). A preview will pop up showing the real address.

   If the address looks unfamiliar, misspelled, or does not match the company that supposedly sent it, do not click it. When in doubt, open your browser and go to the company's website directly by typing the address yourself.

5. Step 5. Look for poor grammar and generic greetings

   Many scam messages have telltale signs of poor quality:

   • Generic greetings like "Dear Customer" or "Dear User" instead of your actual name
   • Spelling mistakes and awkward grammar
   • Unusual formatting — random bold text, strange spacing, or mismatched fonts
   • Blurry or slightly wrong company logos

   Note: AI-generated scam messages are getting better at grammar, so this is not the only thing to check. But combined with other red flags, it is a useful clue.

6. Step 6. Verify by contacting the company directly

   If you get a suspicious message that claims to be from your bank, a delivery company, or a government agency, do not use any contact information in that message. Instead:

   1. Look up the company's official phone number yourself — check their real website or the back of your bank card
   2. Call that number and ask if they sent you the message
   3. You can also log in to your account directly (by typing the website address yourself) to check for alerts

   This one step can save you from almost any scam.

7. Step 7. Never give out sensitive information by phone or email

   No legitimate company will ever ask you for:

   • Your full password
   • Your Social Security number by email or phone
   • Your bank PIN
   • A two-factor authentication code that was sent to your phone
   • Gift card numbers as "payment"

   If anyone asks for these things, it is a scam — no exceptions. Real companies already have your account information and do not need you to "verify" it this way.

8. Step 8. Report suspicious messages

   Reporting scams helps protect other people. Here is how:

   • Scam emails: Forward them to reportphishing@apwg.org
   • Scam texts: Forward the text to 7726 (SPAM) — this works on all major carriers
   • Scam calls: Report to ReportFraud.ftc.gov
   • Scam ads on social media: Use the platform's "Report" button on the post

   You can also report identity theft at IdentityTheft.gov if someone used your personal information.