Features
Part of How to decide what a phishing message actually wants from you
Phishing scams checklist: set up once, then act in order
A phishing scams checklist in two parts: one afternoon of account settings that remove whole categories of risk, and the order of steps after a click.
Two jobs sit under any phishing defense, and they run on different clocks. One is a setup done once. The other is a fixed order of steps for the day something slips through.
Do the setup first if you have the choice. Almost everything that goes wrong goes wrong because the setup was doing none of the work.
What to take away
- Most of the protection is configuration, not vigilance, and it is done once.
- Four questions are enough to decide whether a message needs attention. Anything longer will not get used.
- After a click, order matters more than speed. Money first, then credentials, then the settings that let someone come back.
- The second wave lands in the days after the first click, so the follow-up is part of the checklist.
Four questions before you open anything
Run four questions, in order, on any message that asks you to do something. If the answers point the wrong way, reach the organization your own way and stop there.
Twenty second phishing check
Asked for password, code, payment, install?
run the next three questions
it can wait, ignore for now
- What is being asked for?A password, a code, a payment, or an installation. Anything else can wait until you feel like dealing with it.
- Did I start this?A message that continues something you were already doing is different from one that arrives on its own.
- Is it giving me the route?A link, a number to call, a QR code, an attachment, an app to install. Refusing the route costs nothing.
- Is there time pressure or secrecy?Either one on its own is a reason to slow down. Both together is close to conclusive.
A text saying a parcel is held and a small redelivery fee is due today answers all four the wrong way: it arrives unprompted, asks for a payment, supplies the link, and sets a deadline. How to read what a message wants, and its links, is covered in phishing scams.
The route out is the same each time: a bookmark, the app, a number on a card, or a number already in your contacts.
The afternoon check: settings that remove categories
Done once, this removes whole categories of attack rather than single messages. Work through five groups: sign-in, recovery, the email account, devices and apps, and money.
Afternoon security setup
- Unique password on email, manager, money accounts
- Password manager filling so wrong domains stay silent
- Strongest second factor on top accounts
- Backup codes printed and stored off-device
- Recovery email and phone current and controlled
- Alerting on and pointed somewhere you read
- No unknown forwarding rules or delegated access
- Devices updated, unused connected apps removed
Sign-in
- Turn on multi-factor authentication everywhere it is offered. In Google, open myaccount.google.com, then Security, then 2-Step Verification. In Apple, open Settings, your name, then Sign-In and Security. In Microsoft, open account.microsoft.com, then Security, then Advanced security options.
- Prefer an authenticator app or a hardware key over SMS, which a copied page can relay in real time.
- Save the backup codes where you can reach them without email, such as a password manager or a printed sheet.
The reasoning for the second factor, and which kinds a copied page cannot use, is set out in CISA's guidance on turning on multi-factor authentication.
Recovery
- Nothing listed that you no longer own.
- A recovery email and a recovery phone you still control. In Google, check myaccount.google.com, then Security, then How you sign in to Google. In Apple, check Settings, your name, Sign-In and Security. In Microsoft, check account.microsoft.com, then Security, then Advanced security options.
- Backup codes stored away from the account they recover.
- Old phone numbers and closed email addresses removed from the list.
The email account specifically
Forwarding, filters, apps
- Forwarding. In Gmail, open Settings, then See all settings, then Forwarding and POP/IMAP. In Outlook, open Settings, then Mail, then Forwarding. Delete any address you did not add.
- Filters. In Gmail, open Settings, then Filters and Blocked Addresses. In Outlook, open Settings, then Mail, then Rules. Look for rules that move mail to Trash or mark it read, since those hide a reply.
- Connected apps. In Google, open myaccount.google.com, then Data and privacy, then Third-party apps with account access. In Microsoft, open account.microsoft.com, then Privacy, then Apps and services. Remove anything you do not recognize.
- Sent items and trash, for messages you did not send.
Devices and apps
- Banking and payments done through apps rather than links.
Money
Payment protections
- A rule about payment detail changes, agreed with whoever else can move money.
- Card and account alerts on, so a small test transaction is visible.
Recovery settings and the email account get the closest look because they are what an intruder alters to keep access. The full ordering for the account side is in the social media account security audit.
After a click, in order
Most clicks are nothing. Act on what actually happened rather than on how alarming it felt, and work down the list in this order.
After a click, in order
- Money movedcall bank or payment provider first
- Typed passwordchange it on real site, sign out sessions
- Gave code or approved sign-inassume intruder inside
- Installed somethingdisconnect, remove, change passwords elsewhere
- Work devicetell security immediately, speed over embarrassment
- Preserve screenshots, sender, number, timestamps before cleanup
- Report to provider, impersonated org, national fraud body
- If money moved,contact the bank or payment provider before anything else on this list. What can be done depends heavily on how you paid and on how quickly you call.
- If you typed a password,change it on the real site, change it anywhere you reused it, and sign out all sessions.
- If you approved a sign-in or gave a code,assume someone is inside. After the password change, check recovery email, recovery phone, forwarding, filters, and connected apps, because those are what an intruder alters to keep access.
- If you installed something or allowed remote access,disconnect the device, remove it, and change passwords from a different device. Treat anything typed while it was running as seen.
- If it was a work device or a work account,tell whoever handles this immediately. Speed matters more than embarrassment, and a delay is the only part of this you will actually be judged on.
- Preserve what you can before cleaning up.Screenshots, the sender address, the number, timestamps. That record is what makes reporting useful, and the rest of the sequence is in scam reporting and recovery.
- Report it,to the provider, to the impersonated organization, and to your national fraud reporting body if money or identity documents were involved. In the US that is the Federal Trade Commission's reporting route.
The order exists because each step limits what the next one has to repair. Money moves fastest and credentials next, so both come before any cleaning up.
The three day follow-up
This is the part nobody does, and it is where the second wave lands. Check statements for small unfamiliar transactions, since a small test often precedes a large one.
Three day follow-up
- Day 1-3Check statements for small unfamiliar transactions
- Day 1-3Re-check recovery settings you fixed
- Day 1-3Watch for a new approach referencing the first
- Day 1-3Any fee-based recovery offer is a second scam
Re-check the recovery settings you fixed, because they get changed back. Watch for a new approach referencing the first, since being a known victim is itself a qualification.
Any offer to recover what you lost for a fee is a second scam, not a rescue.
Common questions
I clicked but did not type anything. What now?
Almost certainly nothing. Close the page, do not go back, and keep an eye out for a follow-up message that references it. Opening a page is very rarely the thing that causes harm.
The message knew my order details. Does that change the answer?
No. Personal detail makes a message convincing, not genuine. Check it the way you would have anyway, through the retailer's own app or site.
Should I reply and ask if it is real?
Never on the same channel. A reply confirms the address is live and is answered by the same person who sent it. Reach the organization independently.
Why does the email account get its own list?
Because rules and forwarding there can hide replies and keep an intruder informed. Deleting any address you did not add, and any rule you did not write, removes that route.
Is reporting worth it if nothing happened to me?
Yes. It takes two minutes, it feeds filtering, and the same message is on its way to someone with more to lose.
