How to recognise a suspicious website message or login request

Pause before responding

Suspicious messages try to make a normal business task feel urgent. They may say a domain will expire today, a payment failed, an account will close or a security issue needs immediate action. The request may appear to come from a registrar, host, platform, payment service or colleague. Urgency is not proof of fraud, but it is a reason to slow down and verify.

Do not click a link, open an unexpected attachment or reply with credentials while you are deciding whether a message is genuine. Preserve the original message if it may need reporting. If a real deadline exists, reach the service through a bookmark, a known support number or an address you type yourself.

Use a simple pause rule that everyone can remember: stop, inspect and verify. This is especially useful when the person receiving the message is busy or feels responsible for preventing an outage. A short routine is easier to follow than a long technical policy.

Check sender and context

Look beyond the display name. Check the full sender address and whether the domain is spelled exactly as expected. A familiar logo can come from an unrelated address. Be careful with small spelling changes, extra words, unusual extensions and addresses that imitate a supplier or colleague.

Ask whether you expected the message. Did you request a password reset, DNS change or support ticket? If not, treat the request as unconfirmed. A legitimate service may send reminders, but verify them through the normal account route rather than trusting the message button.

Compare the message with earlier genuine notices from the same provider, but do not rely on appearance alone. Real providers can change templates and attackers can copy old ones. Context and independent access remain the stronger checks.

Inspect the destination safely

On a computer, hover over a link without clicking to preview its destination. On a phone, use a link preview or open the service manually. Check the complete domain, not just a familiar word in a long address. A padlock means the connection is encrypted; it does not prove the site belongs to the company you expect.

Never enter a password, payment detail or recovery code on a page reached through an unexpected message. Open a known bookmark or type the official address yourself. When uncertain, contact support through a published channel.

Check the domain from right to left. The organisation name immediately before the extension is important, while words placed earlier in a long address may be designed to distract you. When in doubt, do not continue on the linked page.

Recognise pressure and unusual requests

Phishing often combines authority with a short deadline. It may threaten suspension, ask for secrecy or claim normal approval is being bypassed. Be cautious when a familiar person suddenly requests bank details, administrator access, a password or a domain transfer. Real names and project details can be collected from public information.

Treat a request as high risk when it changes access, money, domain ownership, customer data or recovery settings. Verify it through a separate channel, using a number already stored in your records or a new message started from the official website. Do not use contact details supplied only in the suspicious request.

Use a second person for requests that affect ownership, money or privileged access. The second check should use independent information, not simply approve the first message. This reduces the chance that urgency becomes a substitute for authorisation.

Protect accounts and website access

Use unique passwords and a password manager for registrar, hosting, email, analytics and website administration accounts. Turn on multi-factor authentication and keep recovery methods current. Give people only the access they need and remove old accounts when someone leaves or a supplier no longer works on the site.

A warning message may be designed to steal a login, but reused passwords and weak recovery settings create risk too. Review sign-in alerts, active sessions and administrator lists after a suspicious event. If credentials were entered, change them from a trusted device, revoke sessions and contact the provider using official details.

Keep recovery email addresses and phone numbers current, but protect them as carefully as the main account. An attacker who controls recovery can regain access even after a password is changed.

Report and improve the process

Report suspicious messages to the relevant provider, internal contact or reporting route. Keep useful message details, but do not forward dangerous links to colleagues without a warning. Tell the team which sign made the message suspicious. A calm report helps others recognise the same pattern.

Create a simple rule: no one approves unusual access, payment or domain changes from a single unexpected message. Use trusted bookmarks, a second approval for sensitive actions and a short incident checklist. Website security is also a repeatable habit that stops a convincing message receiving more authority than it deserves.

Review the process after a real message or near miss. Improving a bookmark, approval rule or training example is more valuable than blaming the person who nearly clicked. Good security makes the safe choice easy.

Sources

• Recognize and report phishing · CISA
• Off the hook: don't be phished · ENISA

Frequently asked

Does a familiar logo mean a message is safe?

No. Logos and copied branding are easy to imitate. Check the sender, destination, context and requested action independently.

What should I do if I clicked a suspicious login link?

Close the page and do not enter information. If you entered credentials, change them through the official service, revoke sessions and contact the provider.

Should I reply to ask whether the message is genuine?

Use a known contact channel instead. Replying can confirm that your address is active and the message may direct you to another unsafe step.