Lockwell

Spot fake messages and calls

Most scams start with a message or a call that pushes you to act fast. Learn the signs, and what to do if you already clicked.

  • 30 min
  • 8 steps
  • Reviewed

Most scams don't break into anything. They persuade you to open the door yourself: tap a link, read out a code, move money. This guide helps you spot them, and tells you what to do if you have already clicked or paid. The five Essential items are habits rather than settings; reading them takes about fifteen minutes.

Essential

A scam message wants you to act before you think. These are the usual signs:

  • It is urgent or threatening: "within 24 hours", a blocked account, a fine.
  • It claims to come from your bank, a delivery company, the police or a government service.
  • It offers a prize, a refund or a deal that is too good to be true.
  • It asks for a login code, a password, card details or money.
  • A friend or relative writes from a new number, or asks for money in an emergency.
  • It asks you to continue the conversation in another app.

Good spelling proves nothing: scammers now write flawless messages with AI. When something feels off, stop and check it another way.

All devices

  1. Don't reply, and don't tap links or open attachments in the message, including an "unsubscribe" link.
  2. Check through a channel you already know: open the company's app, type its address yourself, or call the number on your card or statement.
  3. If a friend asks for money, call them on the number you normally use. A voice on the phone can be faked with AI too: if a call sounds off or asks for something unusual, check another way.
Essential

The code an app or a bank sends you is only for you to type in yourself. Anyone who asks you for it is a scammer, whoever they say they are. Real companies don't message or call you to ask for your password, PIN, card number or login code. The National Bank of Georgia warns never to give anyone your internet banking username and password, and never to make bank or card transactions at a stranger's request.

All devices

  1. If someone asks for a code, end the conversation and block them.
  2. If you are unsure whether a request is real, contact the company yourself, through its app or the number on your card.
Essential

The text of a link can say one thing and lead somewhere else. Fake sites copy logos and use addresses that are one letter off, such as paypaI.com with a capital I. The safest habit: when a message asks you to log in or pay, don't use its link. Open the app, or type the address yourself.

All devices

  1. Copy the link and paste it into our link checker. It shows which site the address points to, without opening it. It can't see past shortened links.
  2. Read the site name from the end. In login.example.com.evil.ge the site is evil.ge; everything in front of it can say anything, even your bank's name.
  3. Before you type a password, look at the address bar. If it isn't the site you expect, stop. If your password manager doesn't offer to fill in the password, check twice.

iPhone

  1. In Safari, touch and hold a link to see a preview without opening it in a tab. The preview does load the page, so for a link you think was aimed at you, use the link checker instead.
  2. Tap anywhere outside the preview to close it.

Computer

  1. Rest the mouse pointer on a link without clicking. The address it leads to appears at the bottom of the window or next to the pointer.
  2. If it doesn't match the text of the link, don't click.
Essential

The name or number on your screen can be faked, so a call can show your bank's real number. A common story: someone from "your bank" or "the National Bank" says a stranger is trying to get into your account or take a loan in your name. To "protect" you, they ask you to log in to your internet banking, take a loan or move money to a "safe" account. The National Bank of Georgia has warned about such schemes, including on WhatsApp, and notes that it never gives loans to individuals. No real bank or police officer asks you to move money to keep it safe.

All devices

  1. Hang up. You don't owe a caller who pressures you any politeness.
  2. Call your bank yourself, on the number on your card or in its app, never on a number the caller gives you.
  3. Never install an app a caller asks for, and never turn off two-step verification or other security features because someone tells you to.
Essential

Act straight away. What to do depends on what happened. Do the steps from a device you trust.

I only clicked

  1. If you didn't type anything, download a file or install an app, a click alone usually does little harm. Update your phone and browser.
  2. Watch your email and account notifications for the next few days.
  3. If you are a journalist or activist and the link seemed aimed at you personally, contact the Access Now Digital Security Helpline. Some spyware has been installed through a single tap on a link.

I typed a password

  1. Change that password now, and on every other account where you used the same one.
  2. Sign out of devices you don't recognise: see the accounts guide.
  3. Turn on two-step verification if it isn't on.

I gave card details or a code, or sent money

  1. Call your bank at once, on the number on your card or in its app, and tell them what happened.
  2. Block the card in your bank's app if it lets you.
  3. Report it to the police.

I installed an app someone asked for

  1. Disconnect from the internet, and remove the app.
  2. Change the passwords you typed while it was installed, starting with email and internet banking.
  3. If you logged in to your bank while the app was installed, call your bank.

If someone got into one of your accounts, see If your account was hacked.

Recommended

On sale sites, scammers often pose as buyers. They send a link "to receive your payment" or "to arrange delivery", and the page asks for your card details. The National Bank of Georgia has warned about this. Others send a screenshot of a payment that never happened.

All devices

  1. Keep the conversation in the site's own chat. Be wary of anyone who wants to move to WhatsApp or the phone early on.
  2. Don't enter card details on a page someone sends you, whatever reason they give.
  3. Don't trust a screenshot of a payment. Check your bank app.
  4. Check a tracking number on the delivery company's own website.
Recommended

Phones and apps can put suspicious messages and calls aside. They catch many scams, not all of them. Screening unknown callers can also hide real calls, from a courier or a doctor, so add numbers you need to your contacts.

iPhone

  1. In Messages, tap the Filter button, then Manage Filtering, and check that Filter spam is on.
  2. On the same screen you can turn on Screen Unknown Senders. Messages from unknown numbers then go to a separate list, and their links don't open until you mark the sender as known. To still get time-sensitive texts such as login codes, tap Allow Notifications and turn on Time Sensitive.
  3. For calls, go to Settings → Apps → Phone → Screen Unknown Callers and choose Ask Reason for Calling or Silence. Screening doesn't work while you are roaming.

Android

  1. In Google Messages, tap your profile picture, then Messages settings → Protection & Safety → Spam and scam protection, and check that it is on.
  2. In Google's Phone app, tap More options → Settings → Caller ID and spam, and turn on See caller ID & spam. Turn on Filter spam calls too, if you see it. Numbers that aren't in your contacts are then sent to Google to be checked.
  3. Phone apps from other makers have their own spam settings.

Viber

  1. Open More → Settings → Privacy → Auto spam check and turn it on.
  2. It checks links and numbers in messages from people you have never chatted with.
Recommended

Reporting helps the app block the sender for other people too. It sends the company copies of the messages: Google Messages sends the last ten (in a group, also the other members' names and numbers), WhatsApp up to five. If the conversation holds anything you don't want to share, block the sender without reporting. Reporting can also delete the message from your phone: if you may go to the police or your bank, take a screenshot first.

iPhone Messages

  1. Swipe left on the conversation, tap the Delete button, then Delete and Report Spam.
  2. If you have opened it, tap Report Spam at the bottom of the message, then Delete and Report Spam. It appears only for unknown senders you haven't replied to. Older versions of iOS call it Report Junk.

Google Messages

  1. Touch and hold the conversation.
  2. Tap Block → Report spam → OK.

WhatsApp

  1. On Android, open the chat and tap ⋮ → More → Block.
  2. Tick Report to WhatsApp to report, or leave it unticked to block only. Check the box: it isn't always ticked.

Viber

  1. Block the sender.
  2. In a message from someone not in your contacts, use the option to report spam.

Gmail

  1. On a computer, open the message.
  2. Next to Reply, click More, then Report phishing.