An Urgent Message Can Feel Real: 3 Checks Before You Act

The message lands in the middle of your day. Can we check it before its urgency becomes our decision?

Maybe you have just parked your motorbike after work when your phone lights up.

A message says your account needs attention. Another might say a parcel cannot be delivered, a payment has failed, or someone from work is contacting you from a new number.

The message does not only describe a problem. It also gives you the link, number, or next step that is supposed to solve it.

That ready-made path is what we need to question.

A useful safety rule is not simply “be more careful.”

It is: move the decision outside the message.

The short version

• Let’s notice what the message is trying to rush us into doing.
• Let’s verify the person or organisation through a route we choose ourselves.
• Let’s confirm that the claimed problem exists before we click, pay, send information, or reply.

1. Find the action hiding inside the urgent story

An urgent message often gives you a worrying story first.

It may say your account is in danger, a payment failed, or a delivery needs immediate attention.

Then it gives you an action: tap this link, call this number, send this code, or pay now.

The story catches your attention. The action is the part that can change your situation.

So the first useful question is:

What is this message trying to make me do before I have time to check?

Maybe it wants you to open a link.

Maybe it wants a password, card detail, verification code, document, payment, or reply.

Phishing is a scam that tries to make an unsafe request look trustworthy, so that you reveal information or take an unsafe action. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, says urgent or emotional wording and requests for personal or financial information can be warning signs. (CISA)

That does not mean every urgent message is false.

A real bank can send an important alert. A real delivery can have a problem. A real colleague can need a quick answer.

Urgency is not proof of a scam. It is a reason to change how you check.

The scale of impersonation scams shows why that pause matters. The U.S. Federal Trade Commission reported in June 2026 that people reported $3.5 billion in losses from imposter scams during 2025. Nearly one in three fraud reports received by the FTC that year involved imposter scams. These are reported losses and reports received by a U.S. agency, not a measure of all fraud in Vietnam or worldwide. (FTC)

An imposter scam is a scam in which someone pretends to be a person or organisation you may trust.

Picture a message arriving just after you have stopped at a neighbourhood café on the way home. It says your bank account will be restricted unless you confirm something within ten minutes.

You do not need to prove that the warning is fake while you are still looking at the screen.

You only need to notice that the message is trying to turn its deadline into your deadline.

That is enough reason to stop following the path it prepared.

2. Reach the sender through a route you already know

Suppose a new chat message claims to be from your bank or from someone at work.

If you use the link, phone number, or reply button inside that same message to prove who sent it, the message is being allowed to prove itself.

That is a circular check.

A stronger check changes the route completely.

CISA advises people not to use a suspicious message’s link, attachment, or phone number to verify it. Its guidance recommends finding another way to contact the company or person directly, such as a company website or a number you already know. (CISA)

The FTC gives similar advice. If an unexpected email or text could be real, it recommends contacting the company through a phone number or website you know is genuine, or contacting the person through a separate conversation. (FTC)

So we can use a simple rule:

Start the check somewhere the suspicious message did not choose for you.

If it claims to be from your bank, close the message and open the banking app or official site you normally use.

If someone using a new number says they are your manager and asks for an unusual file or payment, move to the work channel or saved contact you already use with that person.

If a parcel message looks doubtful, open the order page or delivery account you already know instead of tapping the message’s link.

Imagine you are at your desk in Da Nang before lunch when a new number sends an urgent request that appears to come from a colleague. Rather than continuing inside that chat, you open the normal work conversation you already use with your team and ask there.

The difference is simple:

Message-controlled route: message → link or number → place chosen by the message

Your route: message → stop → familiar app, official site, or known contact

You do not need to become an expert at judging every logo, profile picture, sender name, or writing style.

You can remove the suspicious message from the job of proving itself.

3. Check whether the claimed problem exists outside the message

Reaching a trusted channel answers one question about identity.

It does not yet prove that the event described in the message is real.

Suppose you are expecting an online order at your apartment in Hanoi and a text says the parcel cannot be delivered unless you take action now.

Because you really are waiting for a parcel, the story feels possible.

Instead of using the link, you open the order page or delivery account you normally use.

Now you can ask a different question:

Is there actually a delivery problem recorded there?

Bank alerts show why this second check matters. In 2026, the FTC said some of the highest-loss impersonation scams start with fake security warnings, often using a bank identity, before telling people to move money for supposed protection. (FTC)

So the final check is not only “Who sent this?”

It is also “Can I see the claimed problem somewhere I independently trust?”

The message claims	Leave the message and use	What you are checking
Your account has a security problem	Your normal account app or official site	Is there really an alert or restriction?
A parcel needs action	Your usual order page or delivery account	Is there really a delivery problem?
A colleague needs an unusual payment or file	A work channel you already use	Did that person actually make the request?
A payment failed	The service or account opened separately	Is there really an unpaid balance or failed payment?

Sometimes the claimed problem will be real.

You can then continue through the route you independently verified.

Sometimes there will be no matching problem.

Then the urgent message no longer gets to choose what happens next.

For suspected phishing, CISA recommends reporting the message and deleting it rather than following its links or attachments. (CISA)

The aim is not perfect scam detection.

The aim is to move an important decision away from the place where an unknown sender controls the story, the pressure, and the next button.

Keep the decision on ground you chose

The three checks solve three different parts of one problem.

First, noticing the rushed action stops urgency from becoming evidence. Next, leaving the message keeps it from proving its own identity. Finally, checking the event tells you whether there is a real problem that needs action at all.

The order matters because one check cannot replace another.

A calm message can still be false. A familiar name can still point to the wrong place. A real organisation can exist even when the problem described in the message does not.

So we can keep one short sequence in mind:

Notice the pressure → leave the message → confirm the problem.

You do not need to decide whether every strange message is definitely real or fake.

You only need to stop an unverified message from choosing the route to your decision.

Move closer to the person you want to become

• Let’s spot the action the next urgent message wants from us: click, call, pay, send, or reply.
• Let’s move to a familiar app, official site, saved contact, or normal work channel before deciding who is really contacting us.
• Let’s check that the claimed account, payment, parcel, or work problem exists before we act on it.

Coursera guide

If you want to understand why these messages work and how digital security fits together, structured cybersecurity learning can help you explore phishing, account protection, sign-in checks, networks, and related topics in a clear sequence.

You do not need a course to use the three checks in this article. Structured learning may be useful when you want a deeper foundation and a guided way to keep learning.

Continue reading

← Previous: [Same-country, same-language previous article]

Next: [Same-country, same-language next article] →