Recognize the pattern
How it starts
Texts or messaging alerts containing links.
Your account will be suspended unless verified now.
What happens next
A copied login page captures credentials and codes for account misuse.
Signs to watch for
- The domain or spelling differs
- Unexpectedly demands an urgent login
- The alert requests sensitive details
Start with what you can do now
If this happened to you
Stop entering information and leave the page.
Change exposed passwords through the real website on a trusted device.
If identity information was exposed, use IdentityTheft.gov to review next steps.
What to save
Keep the original records. Use copies to organize the details.
- Original message
- Full URL
- Disclosed-information list
- Unexpected login records
Before you send money
- Open a known app or saved bookmark
- Check the full domain, not the logo
- Enable multifactor authentication
These guides explain common patterns. The facts of your situation and your payment provider’s rules determine which steps are available.
