Pause when pressuredLegitimate organizations allow time to verify a request. Urgency is a common manipulation tactic.
Verify independentlyUse a phone number or website you locate yourself—not contact information in an unexpected message.
Protect security codesNever share one-time passcodes, PINs, seed phrases, recovery codes, or remote-access credentials.
Avoid irreversible paymentsTreat gift cards, cryptocurrency, cash, and wire transfers as high risk when requested unexpectedly.
Use unique passwordsUse a password manager and enable multifactor authentication, preferably through an authenticator or security key.
Verify payment changes verballyConfirm new wire or invoice instructions with a known contact using a previously verified number.
Research before payingSearch the name, domain, phone number, and offer alongside words such as “scam,” “complaint,” and “review.”
Check web addresses carefullyLook for misspellings and deceptive subdomains. A padlock does not prove that a business is legitimate.
Limit public personal detailsInformation about family, work, travel, and birthdays can help criminals create convincing stories.
Talk to someone you trustScammers often demand secrecy. A second perspective can reveal pressure tactics and inconsistencies.