Recommended Free Tools
Do not click first. Treat an unexpected breach, account-security, order, or payment message as unverified—even when it uses a familiar retailer’s name and logo. Check the account through the retailer’s app or a website address you already trust, or call a number obtained independently. Never use the links, phone numbers, attachments, or reply address supplied in the suspicious message.
Why a convincing breach email can still be fake
Phishing is a message designed to look as if it came from a company or person you know, then persuade you to click, download something, or disclose sensitive information. Retailers are attractive disguises because recipients already expect order updates, payment notices, delivery alerts, and security warnings.
As an Amazon Associate I earn from qualifying purchases.
A logo, color scheme, familiar sender name, plausible writing, or an address that appears authentic is not proof of origin. The Federal Trade Commission (FTC) notes that both logos and email addresses can be spoofed. A message can look professional and still lead to a counterfeit sign-in page or a harmful download. See the FTC’s business guidance on recognizing phishing and spoofing.
The safest mental model is that the message is an untrusted claim. Verify the claim through a separate channel before taking any action.
#1 Best Overall
The warning signs that deserve the most scrutiny
| Signal | Why it matters | Safe response |
|---|---|---|
| Unexpected urgency | “Act now,” a short deadline, or a threat of account closure is intended to bypass careful checking. Urgency is a common phishing tactic. | Pause. Open the retailer’s known app or type its trusted address yourself; do not follow the message’s route. |
| A request for a password or one-time code | A legitimate-looking message may be trying to capture credentials or an authentication code. | Do not reply or enter the information from the message. Sign in independently and check for a real alert. |
| A request to “update” payment or account details | The FTC warns that an unexpected email or text asking you to update payment or account information through a link is a warning sign. | Use the retailer’s app, a known-good website, or an independently obtained telephone number. |
| An unfamiliar link or attachment | Links can lead to credential-stealing pages; attachments can install harmful software or exploit an application. | Do not click, download, open, or enable content. Verify separately first. |
| A mismatched sender or generic greeting | These can be useful clues, but scammers can also make a message look polished and personal. | Treat appearance as evidence to investigate, not as an authentication method. |
| Pressure to use the contact details in the message | A scammer controls the supplied link, phone number, and reply address and can route every response to the scam. | Find contact information in the retailer’s app, a previous statement, a card, or a website address you already know. |
The FTC’s consumer guidance explains that phishing messages commonly ask you to click a link, open an attachment, or reveal sensitive information. Its advice on hard-to-spot phishing scams and avoiding the bait emphasizes independent verification rather than visual inspection.
How to verify a breach or account warning safely
- Stop interacting with the message. Do not click a button, open an attachment, reply, call the displayed number, or copy sensitive information into a form reached from the message.
- Decide whether the claimed event is plausible. Do you have an account with that retailer? Were you expecting an order, refund, password reset, or payment notice? An unexpected message is not automatically fraudulent, but it warrants a separate check.
- Open a trusted route. Launch the retailer’s official app, use a website address you have previously verified, or find a telephone number independently from a card, statement, or known official page. Do not rely on any contact detail inside the suspicious message.
- Check the account after signing in through that route. Look for security notices, recent orders, payment changes, new addresses, password-reset activity, and unfamiliar sessions. Follow the retailer’s instructions only inside the independently opened account.
- Contact support through the trusted route if the account does not explain the message. Ask whether the notice was sent and what action, if any, is required. Do not forward the suspicious link to support unless the retailer specifically requests it through a verified process.
- Report and remove the message. Reporting helps providers investigate; deleting it afterward reduces the chance of an accidental later click.
The FTC’s consumer advice asks: “If you get an email or a text message that asks you to click on a link or open an attachment, ask yourself: Do I have an account with the company or know the person who contacted me?” That question is a useful pause, not a guarantee that a message is genuine.
What not to rely on when checking a message
A logo or familiar brand name
Images and sender names are easy to copy. Seeing the retailer’s logo, a customer-service signature, or an order number does not establish who sent the message.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A plausible-looking email address
Addresses can be spoofed or made to resemble a real organization. Even when the visible address looks right, use an independent route for verification. The FTC’s small-business cybersecurity guidance specifically identifies spoofed logos and addresses as phishing warning signs.
Rank #2
Grammar, spelling, or a generic greeting
Errors and generic language may be clues, but sophisticated scams can be professionally written. A polished message can still be fraudulent, so the decision should turn on independent verification.
Hovering over a link
Inspecting a destination may reveal an obvious mismatch, but a hover result does not prove a link is safe. For an unexpected breach or account message, the safer choice is to avoid the supplied link entirely and open the retailer’s known app or site yourself.
What to do in each situation
You received the message but did not interact
- Do not click links or open attachments.
- If the claim could concern a real account, verify it in the retailer’s app, on a known-good website, or through an independently obtained number.
- Report the message using an appropriate reporting channel, then delete it.
For US readers, the FTC advises forwarding phishing email to the Anti-Phishing Working Group (APWG) and reporting it to the FTC; its phishing guidance explains those options. UK readers can forward suspicious email to [email protected]. The UK National Cyber Security Centre (NCSC) says not to click links in a suspicious email and explains the UK reporting process at its phishing-reporting page.
You clicked a link or opened an attachment
A click by itself does not prove that your device is compromised. Risk is higher if a file downloaded, software ran, a browser warning appeared, or you entered information.
- Close the page or document without entering further data.
- Update your security software and run a scan if a link or attachment may have downloaded harmful software. The FTC gives this advice in How To Recognize and Avoid Phishing Scams.
- Install pending operating-system and browser updates from the device’s normal settings, not from a pop-up or message link.
- If the device behaves unusually, disconnect it from sensitive accounts while you seek help from a trusted technician or your organization’s IT team.
You entered a password or authentication code
- From the genuine retailer app or website, change the exposed password immediately.
- Change it anywhere you reused it or used a close variation. Attackers routinely try stolen credentials on other services.
- Review active sessions, recovery email addresses, phone numbers, shipping addresses, and recent account activity; sign out unfamiliar sessions where the service allows it.
- Turn on multi-factor authentication (MFA) if the account offers it.
- Consider a password manager to create and retain a different, strong password for each account, as the FTC recommends in its data-breach advice.
Never give a one-time code to someone who contacts you unexpectedly. A code can be the final step an attacker needs to take over an account.
You shared payment, identity, or other sensitive information
- Use IdentityTheft.gov for recovery guidance tailored to the information exposed.
- If payment-card or bank details were involved, contact the financial institution through the number on the card, statement, or its independently opened app. Explain what was shared and ask what protective action is appropriate.
- Monitor the affected account for unauthorized transactions, new payees, changed contact details, password resets, and unfamiliar logins.
- Keep records of the message, dates, accounts affected, and conversations with providers; preserve the original message only in a safe way that does not require reopening its links or attachments.
The FTC’s data-breach response guidance and its consumer advice on what to do after a breach direct people toward IdentityTheft.gov and account-protection steps.
You lost money or believe an account or device was taken over
Use the fraud or cybercrime reporting route for your location and contact the affected financial or online service immediately. In the UK, the NCSC’s suspicious-email route is not a crime-reporting service: readers in England, Wales, and Northern Ireland are directed to Report Fraud, while readers in Scotland are directed to Police Scotland. The NCSC explains those distinctions at its reporting page. Do not assume a reporting address from one country applies elsewhere.
Choose stronger MFA after you secure the account
MFA reduces the damage from a stolen password, but it does not authenticate an incoming email. A phishing message can still be fake even when the account itself uses MFA. Availability, enrollment, backup, and recovery options vary by retailer and account.
Rank #4
| Method | Practical benefit | Important limitation |
|---|---|---|
| Authenticator app | Generates codes on a device you control and is generally considered stronger than text or email codes by FTC guidance. | You must protect the device and set up recovery before losing it. |
| Security key | A physical key can provide strong phishing-resistant authentication where the account supports it. | Support is account-specific; keep a recovery method and a spare key if the service permits it. |
| Text message code | Often easier to enable than other methods and better than no MFA. | It relies on mobile service and is weaker than authenticator apps or security keys according to FTC guidance. |
| Email code | May be available when other methods are not. | Protection depends on the security of the email account itself and is weaker than stronger available factors. |
Read the FTC’s two-factor authentication guidance for setup and recovery considerations. Never buy or enroll in a method because a suspicious email tells you to; start inside the account’s independently opened security settings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How real breach notices differ from phishing messages
A real organization may contact customers about a security incident, but a message’s existence does not authenticate it. Genuine notices should be checked against the account, the organization’s independently reached support team, and the organization’s official security or privacy information. Do not infer that a message is legitimate merely because it mentions a breach, includes a date, or asks you to reset a password.
Also avoid assuming that every breach notice follows the same legal wording, deadline, or notification method. Requirements differ by jurisdiction and circumstance. If a notice claims that payment or identity information is affected, verify the claim through the organization and follow the relevant financial-institution and identity-recovery steps rather than relying on the email alone.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Reporting routes and what they accomplish
United States
The FTC recommends reporting phishing and forwarding phishing email to APWG. Use the routes described in the FTC’s consumer phishing guidance. Reporting is useful even when you did not lose money, because it can help investigators identify campaigns and take down infrastructure.
Best Value
- This fun, nerdy, geeky, retro Cybersecurity Awareness Month design is perfect to wear this October. Great for cyber security professionals and experts who keep people safe on the internet, safe online, and safe online.
- Wear this for October National Cyber Security Awareness Month this October, raise awareness about cyber security on smartphones, laptops at your school, in the classroom or on your college or university campus. Be safe online and make sure others are too!
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
United Kingdom
Forward suspicious email to [email protected] and follow the NCSC instructions at Phishing scams: how to spot and report them. The NCSC says its email-reporting route is for suspicious messages, not for reporting a crime. Use Report Fraud for crimes in England, Wales, and Northern Ireland, and Police Scotland for crimes in Scotland.
The NCSC page reported 454.8k scam URLs removed as of July 2026. That is an operational takedown figure—not a count of victims, a prevalence estimate, or proof that any particular retailer message is fraudulent.
Other countries
Use your national cybercrime, consumer-protection, or financial-fraud authority. A US or UK reporting address should not be generalized to another country. If money or identity information is at risk, contact the relevant bank, card issuer, or government identity-recovery service through a known channel as well.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
A compact decision checklist
- Unexpected? Pause instead of responding.
- Urgent or threatening? Treat the pressure as a warning sign.
- Requests credentials, codes, payment, or identity data? Do not provide it through the message.
- Contains a link or attachment? Do not use it.
- Need to know whether the claim is real? Open the known app or website yourself, or use an independently obtained phone number.
- Already acted? Change exposed passwords, enable MFA, scan if a download may have occurred, contact financial institutions, and use IdentityTheft.gov when identity information may be misused.
- Need to report? Use the route for your country, distinguishing suspicious-message reporting from crime reporting.
Sources and further guidance
- FTC: Phishing scams can be hard to spot
- FTC: Don’t take the bait on phishing scams
- FTC: Cybersecurity for Small Business
- FTC: How To Recognize and Avoid Phishing Scams
- FTC: Data Breach Response: A Guide for Business
- FTC: Have you been affected by a data breach? Read on
- FTC: Use Two-Factor Authentication To Protect Your Accounts
- UK NCSC: Phishing scams: how to spot and report them
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
