Suspicious message? Check the account without using its links

What the sources report

What remains unclear

No actual suspicious message, account or device was examined for this article. These general guides cannot establish whether a reader’s account is compromised, whether a particular message is genuine, or whether a response has removed every risk. [21] [23]

How the story is being covered

The FTC explains independent verification and consumer response. Microsoft adds account-response steps and workplace escalation. NCSC organizes UK reporting by communication type. These are complementary institutional guides, not independent tests of effectiveness or evidence that a particular message is fraudulent.

Important context

Start outside the message. The FTC recommends checking with the organization through contact information you already trust, rather than details supplied by the sender. Microsoft gives examples: a saved website bookmark or a phone number printed on a membership card, bill or statement. Its guidance says not to open links or attachments in a suspicious message. [21] [23]

Consider a hypothetical text asking for a small payment to release a delayed parcel. Expecting a delivery makes the story plausible; it does not identify the sender. Applying the FTC’s principle, contact the delivery service through a separately obtained, trusted route to ask whether payment is actually required. This is an illustration, not a reported incident or a test of a delivery company. [21]

If you already interacted with the message, describe what happened without assuming a diagnosis: did you open a page, enter information or download something? Microsoft recommends noting the details of a suspected successful phishing attempt, including what information was shared and where it happened. A factual account is more useful than an unsupported claim that a device was hacked. [23]

Possible exposure needs its own response. If you think you fell for a phishing attack, Microsoft advises promptly changing passwords for affected accounts and other accounts using the same password, using unique replacements, and enabling multifactor authentication where available. It also advises notifying your IT support team if work or school accounts are affected. The FTC points people who may have exposed sensitive personal or financial information to IdentityTheft.gov for steps tailored to the information involved. [21] [23]

Reporting is not the same as securing an account. NCSC’s UK guide separates reporting routes for emails, texts, calls, websites and adverts. For US reporting options, consult the linked FTC guide. For a work or school account, involve your IT support team rather than assuming a consumer reporting tool replaces your organization’s process. [21] [22] [23]

Timeline

• 2026-10-10US Crier consulted the linked guidance for this evergreen explainer. This is a research date, not the date of a newly reported cyberattack. [21] [22] [23]

Sources & evidence

1. How To Recognize and Avoid Phishing Scams ↗

   Federal Trade Commission · Retrieved 2026-10-10 21:16:43 UTC

2. Phishing scams: how to spot and report them ↗

   National Cyber Security Centre · Retrieved 2026-10-10 21:16:43 UTC

3. Protect yourself from phishing ↗

   Microsoft Support · Retrieved 2026-10-10 21:16:43 UTC

Updates & corrections

• 2026-10-11 00:19:50 UTCAutomated revision; separate Codex quality review passed. Editorial revision only; no new reporting, human review or rights clearance is asserted.
• 2026-10-10 21:17:35 UTCInitial unpublished draft. Source, rights, risk and separate quality reviews remain pending.

Read our corrections policy →