The one-page scam check
Print it. Put it on the fridge, or next to the phone of someone you worry about. Everything that matters is on this sheet.
The one rule
Never use the phone number, link or address inside the message.
If "your bank" contacts you, hang up or close it. Then reach them the way you
always do — the number on your card, the app on your phone.
A real message survives that. A fake one cannot.
Five warning signs
- It's urgent and threatening. "24 hours or your account closes." Panic is the weapon.
- You weren't expecting it. A parcel you didn't order. A refund you didn't ask for.
- It asks for something no one legitimate asks for. See the red box.
- The sender's address is slightly off. Check the bit after the @ — not the display name.
- The link doesn't match. Press and hold it on a phone, or hover on a computer, to see where it really goes.
Spot two of these? It's a fake.
Never, under any circumstances
- Never give anyone the 6-digit code texted to you. Not even "the bank". Especially the bank.
- Never give anyone your password. Real IT and real banks never need it.
- Never move money to a "safe account". There is no such thing. It is the criminal's account.
- Never pay in gift cards, crypto or wire transfer to someone who contacted you.
- Never let someone control your screen because they called you about a problem.
- Never reply to check if it's real. Replying just proves you exist.
If you already clicked
- Money or card details involved? Call your bank now, using the number on the card. Say "I think I've been scammed."
- Change that password — and anywhere else you used the same one.
- Turn on two-step login for that account.
- Installed something? Disconnect from the internet, uninstall it, run a full scan. Or take it to a repair shop.
- Tell people. Work account → tell IT in the first hour. Personal → warn family.
- Report it. US: reportfraud.ftc.gov · UK: Action Fraud, and forward scam texts to 7726.
Clicked but typed nothing? You're very probably fine. Close it and don't go back.
Set up once, protected for good
- Two-step login on your email first — whoever owns your email can reset everything else.
- A password manager — it won't fill your password into a lookalike site.
- Automatic updates on phone, computer and browser.
- A family safe word — beats "Hi Mum, this is my new number" and AI voice clones.
Three things people get wrong
- A correct logo proves nothing. Anyone can copy a picture.
- The padlock in the address bar means the connection is private, not that the owner is honest. Scam sites have it too.
- Caller ID can be faked. Seeing your bank's real number on screen proves nothing at all.
And when in doubt
Give yourself five minutes. Scams are built for someone reacting instantly. Almost nothing genuine is destroyed by waiting five minutes and checking through a channel you chose yourself. That single pause defeats most of this.
Being caught says nothing about your intelligence. It says someone did this a million times and caught you on a bad day.
Full guide, examples and a test: index page · Free to copy, print and hand out. No tracking, no cookies.