Why this matters

Fraudsters often impersonate customer support agents to trick you into revealing passwords, transferring money, or installing malicious software. This article gives a practical, repeatable method to identify fake customer support messages, verify legitimate callbacks, and document interactions so you can respond safely and preserve evidence if needed.

Recognize impersonation warning signs

• Unexpected contact: You didn’t initiate a support request but receive a message claiming your account has an issue.
• Urgency and threats: Language that demands immediate action (“your account will be closed”) is a common pressure tactic.
• Generic greetings: No account name or personal detail beyond your email or phone number.
• Unusual sender address or number: Slight misspellings in domains (example@paypai.com) or international numbers when the company is local.
• Requests for credentials or codes: Legitimate support will not ask for passwords, full payment card numbers, or one-time passcodes you receive by SMS.
• Links to external files or remote tools: Invitations to download remote-access software or open attachments you didn’t expect are red flags.

Step-by-step verification before you respond

1. Pause and do not click any links or call numbers provided in the message.
2. Check the sender’s details: view the full email header or the exact SMS/MMS sender ID to look for misspellings or mismatched domains.
3. Open a browser and go to the company’s official website yourself (not from the message). Use the Contact or Support section to find the official phone number or chat portal.
4. Call the official number and reference the message you received. Ask the company to confirm whether that contact is legitimate and to provide a case ID if they opened one.
5. If they confirm it’s legitimate, ask the agent to email a ticket from an official domain (for example, support@company.com) and include a ticket number you can verify on the company’s support portal.
6. Document your verification steps (see template below) and only follow instructions given through the official channel you verified.

Worked example (illustrative)

Imagine you receive an SMS: “ACCT ALERT: Your subscription will be cancelled. Call +44 20 7946 0958 immediately.” You didn’t initiate anything.

Do this: 1) Do not call the number in the SMS. 2) Visit the company’s real site and find their support number listed as +1 800 555 0123. 3) Call +1 800 555 0123, explain the SMS, and ask if the company sent it. 4) The agent says it was not sent by them. 5) Record the agent name and time. 6) Mark the SMS as spam, and report it to the company via their official support portal.

Numbers above are illustrative. Replace with the real contact details you find on the company’s website.

Documentation template you can reuse

Copy this short template into a note app or saved document to record every suspect interaction:

Date/time received: 
Channel (SMS/Email/Call/Chat): 
Exact sender info (full email header or phone number): 
Message text (copy/paste or screenshot reference): 
Action taken (did not click, called official number, etc.): 
Official contact used for verification (website URL and phone): 
Company response (agent name, ticket ID, confirmation of legitimacy): 
Follow-up actions (reported to provider, blocked sender, changed password, etc.): 

Easy checklist (one-line actions)

• Pause — don’t click or call the contact in the message.
• Inspect sender details and message tone.
• Open official site yourself and find support contact info.
• Verify by calling official number or opening an authenticated chat session.
• Request an official ticket/email if the contact claims to be from the company.
• Document everything with the template above and report suspicious messages to the company.

Two common challenges and mitigations

• Challenge: The scammer spoofs a company email so it looks exactly like the official address.
  
  Mitigation: Inspect full email headers for Received-from fields and verify via the company’s support portal or phone number listed on the official website. Don’t trust only the visible “From:” field.
• Challenge: You’re short on time and feel pressured to act immediately.
  
  Mitigation: Treat every urgent-sounding support message as suspicious. Use a 5-minute rule: step away for five minutes, then follow the verification steps above. Pressure usually risks mistakes; a short pause reduces error.

FAQ

Q: What if the company’s website listed number is busy?
A: Try email or the verified chat portal on the website. Many companies also list social media accounts (look for the verified badge) that can confirm official channels. Keep documenting your attempts.

Q: Should I ever share a one-time code with support?
A: No. Legitimate support will never ask you to read full one-time passcodes or passwords. If you receive a code unexpectedly, do not share it and report it to the provider.

Q: How do I report a spoofed message?
A: Use the company’s official support page to report abuse, forward phishing emails to the company’s abuse address (if listed), and report SMS to your carrier. Save screenshots and your documentation for follow-up.

Sources and scope

This article offers general editorial guidance for spotting impersonation and verifying callbacks. For authoritative guidance on cyber threats and public resources for reporting, see CISA’s Secure Our World materials: CISA Secure Our World. For practical next steps and additional personal-security guides, start with our site resources: Better Lifestyle: Start Here.

Advice here is not legal, medical, or financial counsel. Treat details such as phone numbers in examples as illustrative only and replace them with the verified contacts you find on the company’s official site.