An Urgent Message Looks Real: 3 Checks Before You Follow It

The message arrives while you are already busy. Can we check it without letting its countdown choose for us?

Maybe you are waiting for food at a mamak stall after work when your phone lights up.

A message says there is trouble with your bank account. Another says a parcel needs attention, a payment has failed, or someone from work is contacting you from a new number.

The message gives you a problem and, almost at the same time, gives you the button, number, or link that is supposed to solve it.

That is the moment to change the route.

The useful rule is not simply “be more careful.”

It is: move the decision outside the message.

The short version

• Let’s notice the action that urgency is trying to rush us into.
• Let’s reach the person or organisation through a channel we already know.
• Let’s confirm the claimed problem before we click, pay, send information, or reply.

1. Look at the action hiding behind the urgency

An urgent message often gives you a worrying story first.

It may say your account has been locked, your payment failed, or your delivery cannot be completed.

Then it gives you an action: tap this link, call this number, send this code, or pay now.

The story catches your attention. The action is the part that can change what happens next.

So the first useful question is:

What is this message trying to make me do before I have time to check?

Maybe it wants a password or verification code.

Maybe it wants card details, a document, a payment, or a reply to a new number.

Phishing is deception designed to make a false sender or request seem trustworthy, so you give away information or take an unsafe step. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, lists urgent or emotional wording and requests for personal or financial information among common warning signs. (CISA)

That does not make every urgent message false.

A real bank can send an important alert. A real courier can have a delivery problem. A real colleague can need a fast answer.

Urgency is therefore not proof either way. It is a reason to slow the decision down long enough to check.

The scale of impersonation scams shows why that small pause can matter. The U.S. Federal Trade Commission reported in June 2026 that people reported US$3.5 billion in losses from imposter scams during 2025. Nearly one in three fraud reports received by the FTC that year involved imposter scams. These are reported losses and reports to a U.S. agency, not a measure of all fraud worldwide. (FTC)

An imposter scam works by borrowing the identity of a person or organisation that you may already trust.

Picture the moment at the mamak table: the message says your account will be restricted unless you confirm something within ten minutes.

You do not need to solve the whole mystery before your food arrives.

You only need to recognise that the sender is trying to make its deadline become yours.

Once you see that, the message no longer has to control your next step.

2. Move to a channel you already know

Now imagine a WhatsApp message from a new number claiming to be your supervisor.

It asks you to send a document or make an unusual payment before lunch.

If you reply inside that chat and ask, “Is this really you?”, the same message is still controlling the check.

The problem is similar if you call the number written inside a suspicious text or open the link it provides to “verify” the alert.

A better check breaks that circle.

CISA advises people not to use the link or attachment in a suspicious message. Its guidance says to report suspected phishing and delete the message rather than interact with it. (CISA)

The FTC also advises contacting a company through a phone number or website you already know is real, or contacting a person through a separate conversation. (FTC)

That gives us a practical rule:

Start the check somewhere the suspicious message did not choose for you.

For a message claiming to be from your bank, close the message and go to the bank through the app or official site you normally use.

If a new WhatsApp number claims to be your supervisor, move to the work group, saved contact, office directory, or another channel you already use with that person.

If the message is about a parcel, open the marketplace order page or courier account you already know instead of tapping the link in the text.

The two paths are easy to picture:

Message-controlled route: message → link or number → place chosen by the message

Your route: message → stop → familiar app, official site, or known contact

You do not have to become an expert at judging every profile picture, sender name, or logo.

You can simply remove the suspicious message from the job of proving itself.

3. Check whether the event exists outside the message

Reaching a trusted channel answers one question about identity.

It does not yet answer whether the problem described in the message is real.

Suppose you are expecting an online order at home and receive a text saying the parcel cannot be delivered unless you make a small payment.

Because you really are waiting for a parcel, the story feels possible.

Instead of using the payment link, you open the order page or courier account you already use.

Now you can ask a different question:

Is there actually a delivery problem recorded there?

Bank alerts show why this second question matters. In 2026, the FTC said some of the highest-loss impersonation scams start with fake security warnings, often using a bank identity, before telling people to move money for supposed protection. (FTC)

So the final check is not only “Who sent this?”

It is also “Can I see the claimed problem somewhere I independently trust?”

The message claims	Leave the message and use	What you are checking
Your account has a security problem	Your normal account app or official site	Is there really an alert or restriction?
A parcel needs action	Your usual order page or courier account	Is there really a delivery issue?
A colleague needs an unusual payment or file	A work channel you already use	Did that person actually make the request?
A payment failed	The service or account opened separately	Is there really an unpaid balance or failed payment?

Sometimes the problem will be genuine.

You can then continue through the route you independently checked.

Sometimes the trusted account or contact shows no matching problem.

Then the urgent message has lost the power to choose what you do next.

The aim is not perfect scam detection.

What matters is where the decision happens. Put it somewhere you chose, not inside a message where an unknown sender controls the story, the rush, and the next button.

Put the decision on a route you control

The three checks work in sequence because they answer three different questions.

First, noticing the rushed action stops urgency from becoming evidence. Next, leaving the message prevents it from proving its own identity. Finally, checking the event tells you whether there is a real problem that needs action at all.

One check cannot replace the others.

Tone alone cannot settle the question. A quiet message may still be false, a familiar name may still point to the wrong place, and a genuine company may have nothing to do with the problem being described.

So we can keep one short sequence in mind:

Notice the pressure → leave the message → confirm the problem.

You are not required to label every unexpected message as genuine or fraudulent on sight.

You only need to keep an unverified message from choosing the route to your decision.

Move closer to the person you want to become

• Let’s pause on the action the next urgent message wants from us: click, call, pay, send, or reply.
• Let’s move to a familiar app, saved contact, or official site before we decide who is really contacting us.
• Let’s check that the claimed account, payment, parcel, or work problem exists before we act on it.

Coursera guide

If you want to understand why these messages work and how digital security fits together, structured cybersecurity learning can help you explore phishing, account protection, sign-in checks, networks, and related topics in a clear sequence.

You do not need a course to use the three checks in this article. Structured learning may be useful when you want a deeper foundation and a guided way to keep learning.

Continue reading

← Previous: [Same-country, same-language previous article]

Next: [Same-country, same-language next article] →