Phishing emails and 'verify your account' messages

Emails that look real but want your password or one-time code. How to spot them.

What phishing looks like

An email arrives that seems to be from your bank, a store, or your workplace. It says your account is locked or you must 'verify' something. It links to a fake page that steals your password.

Red flags:

• A greeting like 'Dear customer' instead of your name
• A threat that your account will be closed 'today'
• A link that doesn't match the real company's address
• A request for your password or a one-time code

The one-time code rule

A verification code is only for logging in to something yourself. No legitimate company will ever ask you to read a code aloud or send it to them. If someone is asking for your code, it's a scam.

What to do

• Don't click the link. Open your browser and go to the company's website yourself.
• If you already entered your password, change it from the real site and turn on two-factor login.
• Report the email as phishing and delete it.

When an email rushes you to 'verify now,' slow down. Real companies can wait.

How do I check whether an email is phishing?

Inspect the sender's full address and the destination of any link without opening it. A polished logo, correct name, or convincing formatting does not establish authenticity. Watch for requests to share passwords, login codes, payments, or sensitive records.

Visit the organization through a bookmark or an address you type yourself. If you entered credentials, change them on the real service and review account activity.

Related: Understand text message scams.