Spot phishing and fake account-renewal messages.

1. Read the request, not just the branding

The FTC describes phishing messages that claim suspicious activity, a payment problem, or an unfamiliar invoice to get people to open a link or attachment. A familiar logo is not proof of authenticity. Ask what the sender wants you to do and whether you expected that request.

As an ATN example, imagine a message saying your membership expires tonight and asking you to “verify” a card through a new link. The useful question is not whether the design looks convincing. It is whether the account you reach independently shows the same problem and provides a legitimate way to resolve it.

Sources: [1]

2. Leave the message and use your own route

Open the app you already use or a saved, trusted website address. If you need support, use the contact information from that known destination. The FTC recommends contacting the company through a website or phone number you know is real instead of details supplied in a suspicious message.

Do not move the conversation to another account or number merely because the sender insists. Keep your question narrow: “Does my account have a billing or access issue?” You can investigate without forwarding identity documents or payment information to the person who contacted you.

Sources: [1]

3. Compare the claim with your own records

Use a receipt, your subscription notes, and the account’s billing area to check the claim. ATN suggests recording these details privately:

A matching date or company name alone does not authenticate the sender. If the account shows a real issue, handle it inside that account or through verified support. If nothing matches, avoid arguing with the sender; keep the message available for reporting.

4. Take the next step if you already responded

If you entered a password or lost control of an account, follow the provider’s official recovery instructions. The FTC’s recovery guide recommends securing the password, signing out other sessions, enabling two-factor authentication, and checking recovery contact details after regaining access. For email, also review unfamiliar forwarding rules. Secure the email account that receives your password resets.

If an attachment may have installed harmful software, update security software and run a scan. If sensitive identity or financial information was exposed, the FTC directs people to IdentityTheft.gov for recovery steps. Use a trusted route to contact your financial provider if payment details were involved.

Sources: [2] [1]

5. Keep a short incident record

Write down when the message arrived, what you opened or entered, and what action you took. You do not need to copy passwords or full card numbers into this record. A simple sequence helps you explain the situation to official support without repeatedly reopening the suspicious link.

Use your email or messaging app’s reporting controls and the service’s official reporting route where available. If an account sent messages without your permission, let affected contacts know through a trusted channel. Afterwards, review the recovery settings you rely on so the next account warning is easier to check calmly.

Sources: [2]