Three questions to ask before you click

Links in emails and texts can lead to dangerous websites. But you don't need to be a tech expert to stay safe. Just ask yourself these three questions.

1. Did I expect this message?

If you get an unexpected email about "your account" or "a package delivery," be suspicious. Legitimate companies don't send random alerts. If it's about something you actually ordered or have an account for, check your official account first.

Scammers count on you being busy or distracted. A message that arrives "out of the blue" — a refund you never asked for, a delivery you didn't schedule, a job you didn't apply for — is almost always the opening move. The safest question is the simplest: was I expecting to hear from this company at all?

2. Does the link match the company?

Hover over (don't click) the link. Does the URL match the company's official website? For example:

Real: amazon.com/returns
Fake: amaz0n-support.com/update

Scammers use similar-looking domains to trick you. They swap letters (a zero for an "o"), add extra words ("-support", "-security", "-verify"), or use a different ending (.net instead of .com). On a phone, where you can't hover, the rule is even simpler: don't tap the link at all — open the company's app or type the address yourself.

A worked example

Here is the whole method on one message. Say you get a text that reads: "USPS: Your package is on hold due to an unpaid redelivery fee. Confirm your address here: usps-redelivery-fee.com"

Question 1 — did you expect it? You didn't request tracking for any package, so no. That alone is enough to stop.

Question 2 — does the link match the company? No. The real USPS site is usps.com, and USPS does not send links in unsolicited tracking texts. "usps-redelivery-fee.com" is a lookalike domain built to fool you.

Question 3 — is it creating urgency? Yes — "on hold" and "unpaid fee" push you to act fast before your package is "returned." Three no's, or a no and a yes, and the answer is the same: do not click. Delete the text and check any package through the USPS app or usps.com directly.

3. Does it create urgency or fear?

Messages that say "Act now or lose access!" or "Your account will be suspended!" are red flags. Real companies give you time and don't threaten immediate consequences.

Urgency is the scammer's main tool, because it short-circuits your judgment. "Pay within 24 hours," "Confirm now or lose your benefits," "Your card has been locked" — all designed to make you act before you think. If a message is pushing you to move fast, that's exactly when you should slow down.

Safe alternatives

Instead of clicking suspicious links:

Type the company's website address directly into your browser
Use their official app
Call them using a number from their official website (not from the message)

What to do if you already clicked

Don't panic — but act now:

Close the page. Don't download anything, and don't enter any more information.
If you entered a password, change it on the real site, and anywhere else you reused it.
If you entered payment details, call your bank or card issuer using the number on the back of your card and tell them what happened.
If you're unsure what you entered, watch your account and report suspicious charges right away.

What the three questions don't catch

These three questions stop most scams, but not all of them. A message can pass all three and still be dangerous if:

The sender's account was hacked — the message comes from a real friend or company, but a scammer is behind it.
It's a "voice call" version of the same trick — someone calling to "verify" your account and asking for a code.
You're being asked to move money or buy gift cards, even by someone who sounds legitimate.

That's why the golden rule still applies even when things look right: never share a one-time code, password, or payment details with someone who contacted you first. Reach out through a channel you chose.

The three questions, in one glance

Keep this short version somewhere handy — on the fridge, or saved as a note on a parent's phone:

Was I expecting this? No → be suspicious.
Does the link (or number) really belong to the company? Doubt it → don't click it.
Am I being rushed or scared? Yes → slow down and verify another way.

Answer "no" to question one, or "yes" to question three, and the safest move is the same every time: stop, and check through a channel you chose yourself — the official app, or the number on the back of your card.

This checklist works for texts, emails, and even phone calls. The scammer changes the story — a package, a bank alert, a grandchild in trouble — but the playbook is the same: unexpected contact, a fake link or number, and pressure to act now. The questions stay the same because the scam does.

Bonus tip

If something feels off, it probably is. Trust your instincts and take the safe route. It's always better to take an extra minute than to rush into a mistake you can't undo.