🕵️ Spot A Scam Text Or Email In Two Minutes

Scams don’t work because people are daft. They work because they’re engineered by professionals to hit you at the exact moment your guard is down - the fake parcel text lands the week you’re actually expecting a parcel, the “unusual activity on your account” email arrives while you’re half-watching telly with one thumb. Urgency is the product. They want you clicking before you’re thinking.

Which means the entire defence is one move: put a pause between the message and your thumb. And it turns out you now have a free, endlessly patient fraud-checker who’s read millions of scam messages, never gets flustered, and is available at 2am when the dodgy text arrives. You just have to build the habit of asking it first.

Two minutes. That’s the whole guide, really. Here’s how to do it properly.

The Kettle Check

I call it the Kettle Check because that’s the speed we’re talking about: stick the kettle on, do the check, verdict before the water’s boiled. Three steps, same order every time.

1. Step away from the message

What it is: the moment something makes your stomach do the little lurch - a fee to pay, an account suspended, a relative in trouble, a prize you’ve won - you don’t click the link, you don’t reply, and you don’t ring any number in the message. You do nothing, on purpose.

How to do it: nothing legitimate expires in the next ten minutes. Banks, HMRC, delivery firms and your own family can all wait for a kettle to boil. If a message is engineered so that waiting feels dangerous, that engineering is the red flag.

The bit everyone misses: replying counts as clicking. Even a sarcastic “nice try” tells the scammer this number is live and read by a human, which upgrades you to the premium target list. Silence is the power move.

2. Paste the message, not your details

What it is: copy the text of the message - long-press on a text, or select-and-copy from an email - and paste it into Claude with the scam-checker prompt below.

How to do it: copy the wording and, if you can, the sender’s number or email address, because those are often where the giveaway lives. Don’t click the link even to “see where it goes” - you can paste the link’s text without ever visiting it.

The bit everyone misses: the message might contain your own details - name, postcode, part of an account number - because scammers buy leaked data to sound convincing. Blot those bits before pasting. Same rule as ever: the message goes in, your personal details don’t. (The 5 Things You Should Never Paste Into AI covers the full list.)

3. Read the verdict, then go in the front door

What it is: Claude gives you a verdict and its reasons. Then - and this is the step that makes you scam-proof rather than just scam-aware - you check with the real organisation directly, using nothing from the message.

How to do it: type the company’s web address yourself, or open their official app, or ring the number on the back of your bank card. If the parcel/refund/problem is real, it’ll be right there when you log in. If it isn’t… now you know.

The bit everyone misses: this step applies even when the verdict is “looks genuine”. The front door is free and takes a minute. The link in the message never has to be clicked by anyone, ever, and you lose nothing by ignoring it.

The scam-checker prompt

Here’s the full version. Save it in your notes app so it’s one paste away at 2am.

Nick this one:

I've received a message and I want you to act as a careful fraud-checker before I do anything with it.

Here's the message, exactly as it arrived (I've blotted out my own personal details):
[PASTE THE MESSAGE]

How it arrived: [text / email / WhatsApp / phone call I'm describing from memory]
Sender shown as: [the number or email address it came from, if you have it]
Context: [one line - e.g. "I am actually expecting a parcel this week" or "I don't have an account with this company"]

Give me your answer in exactly this format:
1. VERDICT - one line: "Almost certainly a scam", "Suspicious: treat it as a scam", or "Could be genuine, but verify directly".
2. RED FLAGS - every sign of a scam you can find in the message, each explained in one plain-English sentence.
3. WHAT THEY'RE AFTER - what this message is trying to get me to do, and what would likely happen if I did it.
4. WHAT TO DO NOW - numbered steps, including how to check with the real organisation without using anything from this message, and how to report it in the UK.

Be blunt. Don't soften the verdict to be polite, and never assume something's fine just because it looks professional. Scams look professional - that's their job.

And the paste-and-go version for when you can’t be bothered finding your notes:

Nick this one (quick version):

Scam or not? One-line verdict first, then your reasons, then what I should do: [PASTE THE MESSAGE]

A worked example: the missed parcel

Say this lands on your phone on a Tuesday:

“EVRl: We attempted to deliver your parcel today but nobody was home. To rearrange delivery please pay a £1.45 redelivery fee within 24 hours or your item will be returned: evri-redelivery-track.com”

You’re expecting a parcel (of course you are, it’s a Tuesday), so it feels plausible. Kettle on, paste it in with the prompt, and the verdict comes back along these lines: almost certainly a scam. The sender name has a capital i pretending to be an l. Real delivery firms don’t charge redelivery fees by text. The web address isn’t the company’s real domain, it’s a lookalike with words bolted on. The 24-hour deadline exists to panic you. And the £1.45 isn’t the prize - the card details you’d type in to pay it are.

Then step three: open the retailer’s own site or the courier’s official app, where your actual parcel is sitting with its actual tracking. Delete the text. Feel quietly smug. That feeling is the habit forming.

One more UK thing worth doing while the kettle’s still warm: forward scam texts to 7726 (free, goes to your network) and scam emails to report@phishing.gov.uk. Thirty seconds, and it genuinely helps get these things shut down.

Before you get carried away

Honesty time. AI is a very good second opinion, not an oracle. A cleverly built scam - especially one using real leaked details about you, or a message genuinely sent from a friend’s hacked account - can get past it. That’s why step three isn’t optional: whatever the verdict, you never click the link, you go in the front door. The habit protects you even on the day the checker gets it wrong.

It’ll also occasionally flag a genuine message as suspicious, because plenty of real companies write like scammers (short-notice deadlines, weird link shorteners… sort it out, real companies). That costs you two minutes of checking directly, which you were doing anyway.

And it can’t judge a live phone call in real time. For calls, the rule is even simpler: hang up, wait a few minutes, ring the organisation back on a number you found yourself.

If you do nothing else

Save the quick version of the prompt in your notes app right now, while you’re thinking about it. The whole defence is having it ready before the dodgy text arrives, because the dodgy text is engineered for the moment you’re not ready.

You’re now the person in your family group chat who checks these things… which means you’re about to be sent every suspicious message your relatives receive. Wear it with pride. And since you’ll be pasting a lot, make sure you know The 5 Things You Should Never Paste Into AI.