Should I reply to a suspicious email or text to verify it?
Why replying is risky
When you reply to a suspicious message, you're telling the sender that your email address or phone number is real and monitored. That can lead to more phishing attempts, spam, or even targeted attacks. Scammers may also use your reply to gather more information or to spoof your address to others.
Even if you reply with something like 'Stop' or 'This isn't me,' you're engaging. For text messages, replying 'STOP' to a scam can sometimes confirm your number is active. For emails, replying can verify your address to a bot that will then sell it to other scammers.
- Confirms your contact info is active
- Increases spam and phishing attempts
- May lead to targeted attacks
- Can be used to spoof your address
What to do instead
Don't reply, click links, or call numbers in the message. Instead, independently verify by contacting the company through a known, official channel. For example, if the message claims to be from your bank, call the number on the back of your card or log in to your account through the bank's official app or website.
If the message is from a person you know but seems odd, contact them through a different method (like a phone call) to confirm. Their account may have been hacked. You can also report the suspicious message as spam or phishing in your email or messaging app.
Reporting and deleting
In most email services, you can mark the message as phishing or spam, which helps train filters. For texts, forward the message to 7726 (SPAM) in the U.S. to report it to your carrier. Then delete it. If you already replied, don't panic—just stop engaging, block the sender, and monitor your accounts for unusual activity.
If you replied with sensitive information, change your passwords and contact your bank or the relevant institution immediately. The sooner you act, the better you can limit any damage.
Common mistakes
- Replying to ask 'Is this real?'—this just confirms your address to scammers.
- Clicking 'unsubscribe' links in suspicious messages, which can also verify your address.
- Calling the phone number provided in the message instead of looking up the company's official number.
