When an Urgent Message Lands on Your Phone: 3 Checks Before You Act

You’re halfway home on the MRT and the message says “act now.” Can we move the check somewhere safer first?

Your phone lights up between stations.

The message says there is a problem with an account, a parcel cannot be delivered, or someone from work needs something urgently.

It also gives you the next move: tap this link, call this number, send this detail, or pay now.

That ready-made path is the part worth slowing down.

A useful safety rule is not “never trust a message.”

It is: move the decision outside the message.

The short version

• Let’s notice the action that the urgency is trying to rush us into.
• Let’s switch to a route we already trust before we decide who is really contacting us.
• Let’s check that the claimed problem exists somewhere the message does not control.

1. Read the requested action before you believe the urgent story

An urgent message often begins with a story that makes you want to react.

It might say that your account is at risk, a payment has failed, or a delivery needs attention.

Then comes the action: open a link, send a code, call a number, share a document, or make a payment.

The story creates pressure. The action is what can change your situation.

So before judging whether the message looks real, ask:

What is this message trying to make me do quickly?

Phishing is a scam in which someone pretends to be a trusted person or organisation so that you reveal sensitive information or take an unsafe action. Singapore’s ScamShield explains that phishing can arrive through emails, messages, calls, or advertisements and can be used to steal passwords, banking details, or card information. (ScamShield)

That does not mean every urgent message is false.

A genuine bank alert can matter. A real delivery can have a problem. A colleague can genuinely need a fast answer.

Urgency is therefore not proof. It is a reason to change the way you check.

The scale of impersonation scams shows why a short pause can matter. In June 2026, the U.S. Federal Trade Commission reported that people reported $3.5 billion in losses from imposter scams during 2025, and nearly one in three fraud reports received by the agency that year involved imposter scams. These are reports to a U.S. agency, not a measure of all fraud in Singapore or worldwide. (FTC)

An imposter scam is a scam in which someone pretends to be a person or organisation you may trust.

Picture yourself standing on a crowded MRT platform after work when a message says your bank account will be restricted unless you confirm something within ten minutes.

You do not need to decide on the platform whether the warning is genuine.

You only need to notice that the message is trying to turn its deadline into your deadline.

Once you see that, you can refuse the route it prepared for you.

2. Start verification from a route you already trust

Suppose you are having lunch at a hawker centre when a message from a new number says it is from someone at work and asks for an unusual file or payment.

Replying “Is this really you?” inside the same chat still keeps the whole check inside a channel chosen by the message.

The same problem appears if a bank-looking message gives you a phone number and you call that number to ask whether the message is genuine.

The thing you are questioning is still choosing how you verify it.

A stronger check begins somewhere else.

Singapore’s Cyber Security Agency advises people to think before using links in unsolicited emails or text messages and to check the authenticity of a request through official sources. ScamShield likewise advises people not to click links in unsolicited messages and to verify information directly with the relevant company or platform. (CSA) (ScamShield)

That gives us a simple rule:

Begin the check from a place the suspicious message did not choose for you.

If the message claims to be from your bank, close it and open the banking app or official website you normally use.

If someone appears to be your colleague from a new number, move to the normal work channel or saved contact you already use with that person.

If a company appears to be contacting you, reach its service through an app, account page, or contact route you found independently.

The two paths now look different:

Message-controlled route: message → link or number → place chosen by the message

Your route: message → stop → familiar app, official site, or known contact

You do not need to become an expert at spotting every fake logo, sender name, or writing style.

You can remove the suspicious message from the job of proving itself.

3. Look for the problem where the message has no control

Now suppose you have just reached your block and are expecting a parcel at your flat when a text says the delivery failed.

Because a parcel really is on the way, the story feels believable. ScamShield specifically includes e-commerce and parcel-delivery messages in its phishing guidance and advises checking the information directly with the company or platform. (ScamShield)

Instead of using the link in the text, you open the order page or delivery account you normally use.

Now you can ask a different question:

Is there actually a delivery problem recorded there?

This is separate from checking who appears to have sent the message.

A trusted route gives you a place to check whether the event itself is real.

The FTC reported in 2026 that some of the costliest impersonation scams start with fake security alerts, often pretending to come from banks, before people are told to move money to “protect” it. (FTC)

So the final question is not only “Who sent this?”

It is also:

Can I confirm the claimed problem somewhere I independently trust?

The message claims	Leave the message and use	What you are checking
Your account has a security problem	Your normal account app or official site	Is there really an alert or restriction?
A parcel needs action	Your usual order page or delivery account	Is there really a delivery problem?
A colleague needs an unusual payment or file	Your normal work channel	Did that person actually make the request?
A payment failed	The service or account opened separately	Is there really an unpaid balance or failed payment?

Sometimes the claimed problem will be real.

You can then continue through the route you independently verified.

Sometimes there will be no matching problem.

Then the urgent message no longer gets to choose your next step.

For suspected phishing, ScamShield advises people not to follow unsolicited links and provides ways to check suspicious messages. CISA also recommends reporting and deleting suspected phishing rather than replying to it or using its links and attachments. (ScamShield) (CISA)

The goal is not perfect scam detection.

The goal is to move an important decision away from the place where an unknown sender controls the story, the pressure, and the next button.

Three checks, one shift: choose the ground where you decide

The first check deals with pressure. You identify the action the message wants before urgency starts to feel like evidence.

The second deals with identity. You leave the message and reach the person or organisation through a route you already trust.

The third deals with reality. You confirm that the account problem, parcel issue, payment request, or work request actually exists outside the message.

These checks work best in that order because none of them can replace the others. A calm message can still be false, a familiar name can still lead to the wrong place, and a real organisation can exist even when the problem described in the message does not.

So the sequence can stay short:

Spot the pressure → leave the message → confirm the problem.

You do not have to decide whether every unusual message is definitely genuine or fraudulent.

You only need to keep an unverified message from choosing the route to your decision.

Move closer to the person you want to become

• Let’s name the action the next urgent message wants from us before we touch its link, number, or reply box.
• Let’s move the check to a familiar app, official site, saved contact, or normal work channel that we chose ourselves.
• Let’s look for the claimed account, parcel, payment, or work problem there before we act.

Coursera guide

If you want to understand why phishing works and how digital security fits together, structured cybersecurity learning can help you explore account protection, authentication, networks, and related topics in a clear sequence.

You do not need a course to use the three checks in this article. Structured learning may be useful if you want a deeper foundation and a guided way to keep learning.

Continue reading

← Previous: [Same-country, same-language previous article]

Next: [Same-country, same-language next article] →