Scams · guides

Phishing and scam calls: what to check before acting

By Alberto Gulotta · Updated · 6 min read

This is the entrance to the scams tower — phishing email, messages that are not from the delivery company, calls from people who already know your name. If money has already left your account, do not read this page: the deadlines are on the identity theft page, and the first hour is the one that matters. If what is being demanded is money in exchange for not publishing something, that is blackmail, where the first instruction is not to pay.

Everything in this tower rests on the same observation. None of this is technical. Nothing is broken into and no password is cracked: you are asked, convincingly and in a hurry, to do something you would never do with time to think. That is why the tower is organised as a catalogue of the asks rather than a list of tools. Recognising the shape of the request is faster and more reliable than inspecting the details of it, and it works on the version that arrives next year in a form nobody has seen yet.

It is also why nothing here shames anybody. The scripts catalogued here are refined against millions of people and they work on careful, intelligent, well-informed adults every day of the week. Anyone who believes they could not be caught is simply describing which script has not been written for them yet.

The floors below that carry a link are open and can be read now; the one marked as being built is not there yet. They are grouped by what actually arrived rather than by the name of the fraud — a verification code nobody asked for, a message or a call, a number you do not recognise — because what arrived is the only thing you know at the moment you start looking. Nothing here is more than three clicks from the front door.

One habit is worth carrying into all of it, because every subject in the plan eventually arrives at the same place. Whenever a message or a call asks you to act immediately, the correct response is not to decide whether it is genuine. It is to leave the conversation entirely and reach the organisation by a route you chose yourself: the number printed on your card, the app you already have, the address you typed by hand. A real bank, a real courier and a real tax office all survive that perfectly well. No scam does.

Where to start

Six ways in. The first three are for the thing in front of you; the last three are for when it has already worked.

“A code arrived and I was not signing in to anything.”
Start in unexpected verification codes
“Is this message real or not?”
Find the channel it arrived by in by channel
“Who keeps calling me from this number?”
That is checking a number
“I sent money and I think it was a scam.”
The deadlines start now, and they are on Identity theft
“The call was in a voice I recognised.”
That has its own page: Grandparent scams, and the voice that is not theirs
“The texts will not stop.”
What actually reduces them is in How to stop spam texts, and what blocking cannot do

Unexpected verification codes

A verification code arrives for a sign-in you did not start. What it means depends on two things: whether it came once or keeps coming, and which company actually sent it — which is often not the one whose name is in the message.

Link verification codeWhy Link sent it, the difference between a code that came once and one that keeps coming, and what to close.Open this guide → Shop verification codeThe Shop Pay code nobody asked for, and the official form that removes your number without replying to anything.Open this guide → The short code it came fromWhat can and cannot be established about who operates a five-digit short code, and why the answers online contradict each other.Open this guide →

By channel

The same trick arrives through different doors, and each door has its own tells. What to look at first is almost never the thing the message wants you to look at — and the channel decides the remedy, because an email forwards somewhere, a text forwards somewhere else, and a call forwards nowhere at all.

Phishing emailWhat to check first, why the sender’s display name is worth nothing at all, and the sign that has stopped working.Open this guide → Smishing and vishingWhat the two words mean, and why the channel they name changes what you can actually do about it.Open this guide → The parcel textWhy “the Postal Service never texts” is false, and the two-part rule that tells a real message from a fake one.Open this guide → Reporting phishing in OutlookFour clicks, and the reason reporting does not block the sender.Open this guide →

Checking a number

What you can genuinely find out about who called — and what the lookup sites themselves are doing with the number you type into them.

Spoofed caller IDWhy your bank’s real number appearing on your screen proves absolutely nothing.Open this guide →
Unknown numbersWhether to call back at all, and what can actually be found out about a number you do not recognise.Being built

Not covered here. It will not sell you protection. There is a large industry offering subscriptions that promise to stop this, and what this tower will ask of you is not a product. What it requires is a rule you decided in advance — hang up and call the number on the back of your own card — and rules are free.

It will not publish a list of scam numbers. Numbers are spoofed and rotated constantly, such a list is out of date the day it is written, and treating an absent number as a safe one is exactly the mistake this tower exists to prevent.

And it will not tell anybody they were stupid. That word is why most of this goes unreported, why families find out months later, and why the same script keeps working. Every guide here will be written to be forwarded to somebody who is in the middle of it, which rules out a certain tone entirely. What holds instead is simple: written to be forwarded to somebody who is about to pay, and never carrying an affiliate link.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 20 August 2026 · last checked 10 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.