Is this a scam? A 60-second check you can do yourself

You have a message open and something feels off. You want a yes or a no, and the honest answer is that no one can give you one from a screenshot. What you can do is check four things, in this order, without clicking anything.

1. Read the actual sender address

The name at the top is text the sender typed. Tap or hover it and read the address underneath. Your bank writes from its own domain, not from a domain that contains your bank's name plus a word like secure, verify, or support. On a text message, the sender ID can be spoofed entirely, so a message from your bank's name proves nothing.

2. Find where the link really goes

On a computer, rest the pointer on the link without clicking and read the address in the corner of the screen. On a phone, press and hold, then read the preview. If the address is not exactly the domain you already know, stop. A link can say one thing and point anywhere.

3. Look at how they want to be paid

Gift cards, bank transfer to a person, crypto, or a payment app to an individual. No real company, tax office, utility, landlord, or delivery firm asks for any of those. This single check catches most of the scams that get past the first two.

• Someone asks for a password, a PIN, a full card number, or a one-time code.
• The message creates a deadline measured in hours.
• It says your account is already compromised, then offers a number to call.
• The contact details are only in the message, never on the official site.
• A job, refund, or prize requires a fee paid up front.

4. Hang up and call the number you already have

If the message claims to be your bank, your card issuer, or a delivery company, end the conversation and call the number on the back of your card or on your last real statement. Never the number in the message. If the message was genuine, the same information will be in the company's app when you open it yourself.

If you already clicked or paid

Do not panic and do not delete anything yet. Change the password on that account from a different device, turn on two-factor authentication, and check recent activity. If you gave card details, call the issuer and ask them to block and reissue. If you sent a bank transfer, call your bank immediately: the first hour is the only hour where a recall is sometimes possible. Then report it to your country's fraud reporting service.

The rule to keep

Real organisations do not need your password, do not need to be paid in gift cards, and do not mind you hanging up and calling back on a number you found yourself. Every check above is a version of that one sentence.