Emails that want you to sign in, pay, or open something

You don’t have to decide whether an email is real. Close it, and check the account in its app or on a site you type in yourself. If something’s wrong, it’ll be there too.

If it’s happening now

It wants you to sign in, verify, or update a payment. Don’t use its button or link. Open the company’s app, or type its address yourself.

It gives a number to call about a charge. Don’t call it. Look for the charge in the app or on your card statement. If it’s there and you didn’t make it, call the number on the back of your card. If it isn’t there, delete the email.

It has an attachment or a document to open. Don’t open it unless you were expecting that exact file from that person. Ask them by phone or text, not by replying.

It’s from someone you know and asks for money, gift cards, or new bank details. Call them on the number you already have. Their email may be hacked, or the address may be one letter off. A reply goes to whoever sent it.

A sign-in page opened and your phone or browser didn’t fill in your saved password. Close it. Saved passwords fill in only on the site they were saved for. Don’t type it in by hand. Go to the site the way you usually do.

A call or video call backs it up. A familiar voice or face proves nothing. Call back on a number you already have.

It came to your work email. Use your company’s Report button. If you clicked or typed anything, tell IT now.

What to say

• I typed my card number into a page I got to from an email. Can you cancel the card, send me a new one, and check for anything pending? I'd like a case number.

• I signed in to a fake copy of your site from an email link, so they may have my password. Can you lock my online banking, check for transfers and anyone new added to send money to, and give me a case number?

• Hi, it's me. Did you just email me asking for gift cards? I'm calling instead of replying, in case someone's in your email.

• I got an email from you saying your bank details changed. I'm calling the number I already have for you before I send anything.

If something already left your hands

You clicked or opened something

Close the page. If a file downloaded, delete it without opening it. Don’t install or paste anything the page asks you to. Already opened a file, installed something, or pressed keys a page told you to? Stop using that device for banking and email, change those passwords from another device, and update the security software and run a scan. More: I let someone control my computer.

You typed a password

Change it now, in the app or on a site you type in yourself. If it was your email password, do that one first: whoever controls your email can reset your other accounts. Used it anywhere else? Change it there too. Typed in a code too? Assume they got in, and sign out devices you don’t recognize. Once you’re back in, add a passkey or an authenticator app if the account offers one. A passkey won’t work on a fake page. Lock down your accounts in 30 minutes. Full steps: I gave out a code, password, or card number. Locked out: Someone got into my account.

You typed a card number

Call the number on the back of the card and ask for a new card. Credit card: dispute charges you didn’t make, in writing, within 60 days of the statement that shows them. Debit card: if you still have the card, you owe nothing for charges you didn’t make, as long as you report them within 60 days of the statement that shows them. Report it today anyway: it’s your own money that’s missing until they put it back. Typed your PIN too? Ask for a new one, and report within two business days. I paid with a credit or debit card.

You paid an invoice or sent money

Call your bank or the payment company, using the number on your card or in the app. If you sent it yourself, they may call it authorized, and it often isn’t reimbursed. Ask for a recall anyway, and for their decision in writing. If they say no, file a complaint at consumerfinance.gov/complaint. Sent a wire? File at ic3.gov at the same time as you call the bank. Keep the email. They’ll both want it. Steps by payment type: I paid or sent money.

Anyone who later offers to get it back for a fee is running a second scam. Someone offers to get my money back.

You called the number in the email

Hang up. If they connected to your computer or had you install an app, hold the power button until it shuts off, then use another device. Call your bank on the number on your card, especially if you signed in to your bank or gave a card number while they were on the line. Steps: I let someone control my computer. If they say they refunded too much and want the difference back in gift cards, a wire, crypto, or a payment app, that’s the scam.

You replied

Stop replying. If your reply had a password, card number, or code in it, use the steps above.

Then report it

• Gmail on a computer: open the email, click More (the three dots next to Reply), then Report phishing. In the Gmail app, tap More, then Report spam.
• Outlook: select the email, then Report, then Report phishing.
• iCloud Mail: move it to Junk. If it pretends to be Apple, forward it to reportphishing@apple.com.
• Any email: forward it to reportphishing@apwg.org.

If you lost money or gave out information, also report it at ReportFraud.ftc.gov.

What it looks like

7:40 a.m. Your phone shows the sender as Amazon. You do have Prime, and your Visa does end in 4829.

Payment method update needed for your Prime membership

A

Amazon

7:38 AM

Hi Margaret,

We weren't able to process the renewal payment for your Amazon Prime membership using the Visa ending in 4829.

This sometimes happens when a card expires or when your bank flags a charge for review. Your Prime benefits are paused until the payment goes through.

[ Update Payment Method ]

If you've updated your card in the last 48 hours, you don't need to do anything.

Thanks for being a Prime member since 2019.
Amazon Prime

What do you do?

• Tap Update Payment Method. Your name and card are right
• Tap Amazon at the top to see the full address first
• Open the Amazon app yourself and go to Your Account, then Prime Membership

Show the answers

• Wrong move Tap Update Payment Method. Your name and card are right Your name and the last four digits of your card turn up in data breaches and on receipts. The button opens a page built to collect your Amazon password and your full card number.
• Okay Tap Amazon at the top to see the full address first Here it shows no-reply@amzn-primebilling.com. Amazon's emails come from amazon.com addresses, so you'd stop. But some scam emails come from a company's real address, so a clean address wouldn't make the button safe.
• Best move Open the Amazon app yourself and go to Your Account, then Prime Membership Amazon says that's where to check your membership and pay, and that every email it sends also shows up in Message Center. If the card really failed, you'll see it there and can fix it there.

Your name, your card's last four digits, and a well-written email prove nothing. The app shows whether anything is actually wrong.

4:06 p.m. You have a PayPal account. You've never used Docusign.

Account Activation

D

Docusign <dse@docusign.net>

4:06 PM

Activate your Docusign account

PayPal Billing Department: Your payment of $749.99 USD to Coinbase Inc. (Bitcoin purchase) has been processed. Invoice PP-8830-2219. If you did not authorize this transaction, call PayPal Support at +1 (808) 555-0163 within 24 hours to cancel and receive a full refund.

[ ACTIVATE ]

You're receiving this email because an account was created with this email address.

It came from docusign.net, Docusign's real address. What do you do?

• Call the number before the 24 hours run out
• Open the PayPal app yourself and look at your activity
• Forward it to verify@docusign.com, then delete it

Show the answers

• Wrong move Call the number before the 24 hours run out That number reaches the scammer. The FTC says callers get asked for remote access, or to type bank or card details into a 'refund' page.
• Best move Open the PayPal app yourself and look at your activity No $749.99 payment there means nothing happened, and you can delete the email. If there is one, contact PayPal through the Help Center in the app, or call the number on the back of the card it was charged to.
• Okay Forward it to verify@docusign.com, then delete it Docusign asks for it as an attachment, and it helps them shut down the sender. It doesn't tell you whether any money moved. Checking PayPal does.

Docusign delivered it. A scammer wrote it. Check PayPal in the PayPal app.

You typed fernmontbank.com yourself, tapped Forgot password, and entered your email. This arrives a minute later.

Reset your password

F

Fernmont Bank <no-reply@fernmontbank.com>

10:02 AM

We got a request to reset the password for your Fernmont online banking.

[ Reset password ]

This link expires in 20 minutes. If you didn't ask to reset your password, ignore this email. Your password won't change.

It wants you to set a new password from a link in an email. What do you do?

• Delete it. Banks don't send links
• Tap Reset password
• Call the number on your card and ask them to reset it

Show the answers

• Wrong move Delete it. Banks don't send links Banks send reset links when you ask for one. Deleting it just leaves you locked out.
• Best move Tap Reset password You asked for it a minute ago, on a site you typed in yourself, and it arrived right after. That's how password resets work.
• Okay Call the number on your card and ask them to reset it Safe, and they can help. It takes longer than the link you asked for.

A reset link you asked for a minute ago is fine. One you didn't ask for: leave it alone. Your password hasn't changed.

What they’ll ask for

Same move for each: close the email and go there yourself.

“Verify your account within 24 hours or it will be suspended.” “Your payment didn’t go through.” Open the app or type the site in. A real problem shows up inside your account. For Prime: Your Account, then Prime Membership.

“If you didn’t authorize this charge, call us.” Don’t call. Look for the charge in your account. If it isn’t there, there’s nothing to cancel.

“Please review and sign.” Not expecting a document? Ask the sender on a number you already have. To open it safely, go to docusign.com, click Access Documents, and type in the security code from the email. That shows Docusign delivered it, not that the sender is honest. Docusign says it never requires you to download software to see a document.

“Your mailbox is full” or “Your password expires today.” Open your email app the usual way. If storage were full, it would say so there. At work, ask IT. Gmail says it won’t ask for your password by email.

“To prove you’re not a robot, press the Windows key and R, then Ctrl and V, then Enter.” (On a Mac: “Open Terminal and paste this.”) Close the page. Those keys run a command the page copied for you when you ticked the box. Real robot checks happen inside the page. A pop-up or call says your computer has a problem.

“Our wiring instructions have changed.” Buying a home or paying a contractor? Call them on a number you got before this email, like the one on your paperwork. Read the account name and number back to them before you send anything.

What not to waste time on

Spelling and grammar. The FBI says criminals use AI translation tools to cut spelling and grammar errors. A well-written email with your name in it proves nothing.

Whether the face on a video call is real. In early 2024, a finance worker at Arup’s Hong Kong office sent about US$25.6 million after a video call where the finance chief and colleagues were all AI fakes. Before money moves, call back on a number you already have.

Rehearse a sign-in page that won’t fill in your saved password in the Practice Lab (“Let the manager remember a login”).