How to Check If a Message Is a Scam: 6 Steps

To check if a message is a scam, stop before acting, read the real sender address and link domain letter by letter, look the company up yourself and call back on a number you already have, and use an approved AI assistant as a second opinion on a cropped screenshot. Then report it, and move fast if money or a login was involved. The same six steps work for emails, texts, calls, DMs and websites.

The scale explains why a repeatable method beats instinct. The FTC told Congress that in 2025 consumers submitted 3 million fraud reports and reported $15.9 billion in losses. Imposter scams alone accounted for $3.5 billion, and people reported losing nearly $1 billion to scammers posing as businesses. Those are consumer figures, but the same messages reach people at work, wearing the names of your bank, your vendors and your own leadership.

How do you check if a message is a scam, whatever the channel?

The channel changes, the pattern does not. A scam message borrows a trusted name, asks you to do something unusual, and gives you a reason to do it now. That holds for a fake invoice by email, a parcel text (smishing), a call from "the bank" (vishing), a QR code on a flyer (quishing), or a request to change payment details (business email compromise).

The steps below follow the order you would use them. The mechanics behind each lure are in how phishing actually works and how to spot it.

Step 1: Stop before you click, reply, call or open anything

Do not click links, open attachments, reply, scan the code, or call any phone number given in the message. Each of those moves you into a channel the sender controls. If it is a live call, it is fine to say you will call back and hang up.

Treat urgency as the signal to slow down. Real banks, vendors and executives can wait for a check. A message that insists it cannot wait is telling you something about itself.

Step 2: Read the real sender and link domain letter by letter

Look past the display name to the actual email address or phone number, and hover over or long-press links to see the real destination without opening it. Then read the domain one character at a time. The FBI gives examples of lookalike domains imitating a real company's address: "@co-pany.com", "@company-usa.com" and "@companygroup.com."

The FBI's 2026 warning on typo squatting notes that it "relies on Internet users making mistakes, such as common typos," including swapping .org for .com. A single extra letter, a hyphen, or an added word such as "secure" or "support" is enough to treat the message as unverified.

Step 3: Look the company up yourself and call back on a number you already have

Find the contact details independently: from a contract, a past invoice, the back of a bank card, or a bookmarked website you typed yourself. CISA's advice is to contact the company directly and "do not use contact information provided on a website connected to the request."

The FBI says the same about calls: hang up, research the contact for the organization, and call it directly. This is the single most reliable step, because it does not depend on spotting anything. If the request is real, the person on the known number will confirm it.

Step 4: Screenshot it and ask an AI assistant for a second opinion

This is the step I use myself, with Gemini. Take a screenshot of the message and ask an AI assistant three questions: is this company real, does the sender domain or link match that company's real domain, and does this fit a known scam pattern? Use whichever assistant your company has approved, such as Gemini, ChatGPT, Claude or Copilot.

Four rules keep this safe:

• Crop out customer and personal data first. Names, account numbers, addresses and anything about a client come off the image before it goes anywhere.
• Follow your company's AI-tool policy. Use the assistant your company has approved. If there is no policy yet, governing shadow AI by enabling it explains why approving a tool beats pretending nobody uses one.
• Never upload the attachment. Screenshot the message only. The attachment may be the payload.
• Treat the answer as a second opinion. An AI assistant can miss a scam that is too new to be known, and it can wrongly flag a real company. If its answer and your callback disagree, the callback wins.

How do you check if a website is legitimate?

The same method applies to a login page or payment page you reached from a message. Read the domain in the address bar letter by letter, and if there is any doubt, close the tab and type the company's address yourself or use a bookmark. The FBI's QR code warning gives the same advice for payments: type the URL manually rather than trusting a link or code.

For QR codes, the FTC advises that "if you see a QR code in an unexpected place, inspect the URL before you open it." A site you can only reach through the message, and not by searching for the company yourself, is the one to treat as suspect.

Step 5: Report it the company way, even if you did nothing wrong

Use your company's report button or reporting address, then delete the message. A report lets the person responsible warn colleagues and remove copies before someone else engages. What to do with a suspicious email covers the reporting setup in detail, and DMs to company social accounts belong in the same route, as protecting company social media accounts explains.

Outside the company, the FTC advises forwarding phishing emails to [email protected] and phishing texts to 7726 (SPAM), and reporting fraud at ReportFraud.ftc.gov.

Step 6: If money or a login was involved, act straight away

If you sent money, call your bank now and request a recall. The FBI's 2025 Internet Crime Report puts it plainly: "time is of the essence. Immediately, contact your financial institution and request a recall of the funds." Then, "regardless of the amount lost, file a complaint at www.ic3.gov." In 2025 the FBI's Recovery Asset Team helped freeze $679,013,183 across 3,900 incidents, according to the same report, which is why the first call matters.

The FTC's guidance for people who paid a scammer adds the specifics: report a wire to the wire transfer company immediately, contact a gift card issuer immediately, and report a bank transfer to your bank. If you entered a password, reset it from a trusted device and tell IT, and if you approved an unexpected prompt, see what is MFA fatigue. Be wary of anyone who then offers to recover your money: IC3 warns that it does not work with recovery services and "will never directly contact you for information or money."

What should a company set up so checking is easy?

Staff will check if checking is quick and nobody is blamed for asking. Three things make that true: one obvious way to report, a callback list of known numbers for banks, key vendors and leadership taken from contracts rather than emails, and an approved AI assistant with a clear rule about cropping data out of screenshots.

The last piece is cultural. Thank people for every report, including false alarms and including the ones who clicked first and reported second. The fast honest report is what lets the bank call happen in time.

At Kief Studio we build the verification into the systems themselves, so a payment change or a login approval cannot go through on one person's say-so. We also run remote team sessions on exactly this: the messages your staff actually receive, how to run these checks quickly, and how to use AI assistants safely while doing it. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.

Related reading

• How phishing actually works and how to spot it
• What is business email compromise?
• What is vishing?
• What is smishing?
• Shadow AI: govern by enabling

Frequently Asked Questions

How can I tell if a message is a scam?

Look for a trusted name paired with an unusual request and a reason to act now. Then verify: read the real sender domain letter by letter, and contact the company on a number you already have rather than any number in the message.

Can I use ChatGPT or Gemini to check if a message is a scam?

Yes, as a second opinion. Crop out personal and customer data, never upload attachments, and follow your company's AI-tool policy. AI can miss a new scam or flag a real company, so a callback on a known number still decides.

How do I check if a website is legitimate?

Read the domain in the address bar character by character and look for extra letters, hyphens or swapped endings such as .org for .com. If in doubt, close it and type the company's address yourself.

What should I do if I already sent money to a scammer?

Call your bank immediately and request a recall of the funds, then file a complaint at ic3.gov, as the FBI advises. For gift cards or wire services, contact the issuer or transfer company straight away.

Should I report a scam message if I did not fall for it?

Yes. Report it through your company's route so others can be warned, and forward phishing emails to [email protected] or texts to 7726. Reports help stop the same message reaching someone else.