How can I check a suspicious message without clicking its links?
Quick answer
Do not click links or attachments, reply, or use an unsubscribe link in a message you suspect is fraudulent. Check for warning signs such as urgency, shortened URLs, a sender-address mismatch, unexpected attachments, or requests for personal or financial information. If the message claims to come from an organization, contact it using details you find independently on its webpage—not details in the message. Report it through your email service’s spam or report feature, then delete it as appropriate. [S1]
The question, the details, the next step.
I got a message saying my account will be restricted unless I confirm my details today. How can I check whether it’s suspicious without clicking anything?
Treat it as suspicious while you check. Don’t click a link or attachment, reply, or use an unsubscribe link in the message. CISA lists urgency, shortened URLs, sender-address mismatches, unexpected attachments, and requests for personal or financial information as warning signs. [S1]
You can inspect the message itself without following its instructions. Note what it claims, what action it demands, and whether the sender address appears to match the organization it names. One warning sign alone may not settle the question; the safer next step is to verify the claim independently.
Can I just look at the link to see where it goes, as long as I don’t open it?
You don’t need to interact with the link to check the message. A shortened URL is one warning sign CISA identifies. [S1] Avoid clicking it, copying it into a browser, or using it to reach the organization. Instead, find the organization’s webpage independently—using a route you already trust or searching for its official site—and look there for contact information.
The sender name looks familiar. What should I compare, and how do I contact the company safely?
Compare the displayed sender address with the organization named in the message, and note any mismatch. Don’t use a phone number, reply address, or webpage link supplied by the suspicious message to verify it. CISA recommends contacting an impersonated organization through contact information found independently on its webpage. [S1]
For example, if a message claims to be from “[Organization],” go to that organization’s webpage without using the message’s link and use the contact details published there. Ask whether the claimed notice is genuine. This example is a process template, not evidence that any particular message or organization is legitimate.
What details should I keep, and what do I do with the message afterward?
For your own report, make a brief note of the sender address as displayed, the message’s subject, when you received it, what it asks you to do, and the warning signs you noticed. Treat that as an organizing aid—not as proof of who sent it. Don’t include passwords, payment details, or other sensitive information in a note you plan to share.
Use your email service’s spam or report feature. CISA recommends reporting there and deleting the message after reporting, as appropriate. [S1] If you’re unsure whether to delete it, you can first use the report option and follow any instructions shown by your email service; don’t reply or click through to investigate. The cited guidance does not establish whether a particular message is fraudulent or describe every provider’s reporting process.
A practical checklist
Pause: do not click links or attachments, reply, or use an unsubscribe link in the suspicious message. [S1]
Note the message’s claim, requested action, sender address, and any urgency or unexpected attachment.
Treat shortened URLs, sender-address mismatches, and requests for personal or financial information as warning signs. [S1]
Find the named organization’s webpage independently and use its published contact information to check the claim. [S1]
Report the message with your email service’s spam or report feature; delete it afterward as appropriate. [S1]
A few more useful answers
Is a familiar sender name enough to trust the message?
No. Compare the displayed sender address and check the claim through contact information found independently on the organization’s webpage. A familiar name by itself does not verify the message.
Should I reply to ask whether the message is real?
No. CISA advises not replying to a suspicious message. Contact the organization using information you find independently instead. [S1]
What if I already clicked a link?
This guide’s source addresses how to handle a suspicious message before interacting with it; it does not establish what happened after a click or provide incident-recovery steps. Don’t enter requested information through the message, and contact the named organization through an independently found route if you need to check its claim.
Sources
References used for this guide.
- [S1] CISA Secure Our World phishing tip sheet cisa.gov · Checked