How to recognize an official source.
Fake websites and messages copy logos and layouts well. Checking a few details, such as the address, the request and the way out, tells you whether a site or message is genuine.
Check the address
The web address is harder to fake than the design.
- Read the full domain name, not just the logo
- U.S. government websites end in .gov
- Watch for extra words, swapped letters or extra hyphens
- Look closely at the part just before the .com or .gov
Look-alike tricks
Common ways fake addresses imitate real ones.
| Trick | Example pattern |
|---|---|
| Swapped letters | A letter replaced with a similar one, like rn for m. |
| Extra words | The real name plus words such as -support or -secure. |
| Different ending | The real name with .co or .net instead of the official ending. |
| Subdomains | The real name at the start, with a different site at the end. |
Check the message
Scam messages share familiar patterns.
Urgency
Threats and countdowns are red flags.
Odd payment
Requests for gift cards or cryptocurrency are scams.
Secrecy
Being told not to tell anyone.
Codes
Nobody legitimate needs the code you just received.
A safe way to check
When in doubt, verify through a route you control.
Stop
Do not click, reply or call the number in the message.
Find the official contact
Type the official address yourself or use the number on your card.
Ask
Ask whether the message is real.
Report
Report fakes to the organization they imitate.
Where to report
Reporting helps protect the next person.
The real organization
Most have a page for reporting fake messages using their name.
Your email provider
Use the report or spam button so similar messages get filtered.
Your bank
Call the number on your card at once if you shared payment details.
Consumer protection
National and state consumer-protection agencies collect scam reports.
Common questions
About spotting fake official messages.
Can a message show the real company name and still be fake?
Yes. Display names are easy to fake. Check the full address and any links before trusting it.
Is a padlock in the browser a sign that a site is official?
No. It only means the connection is encrypted. Fake sites can have it too.
What if I already clicked a link?
Close the page, do not enter anything, change the password of any account involved, and watch your accounts for unusual activity.
Do real organizations ever ask for passwords by email?
Reputable organizations do not ask for your password or one-time code by email, text or phone.