Spot A Scam Text Or Email In Two Minutes
A two-minute move that pulls the signals out of a suspicious message and hands you back a decision. It never tells you it's a scam, and that's the point.
When you work for yourself, the scams get more convincing. A fake invoice from a supplier you actually use. A domain renewal notice. A new client enquiry with an attachment. An HMRC letter arriving the same fortnight you were expecting one.
They land during the working day, they look like work, and you’re already holding four other things.
The fix is putting two minutes between the message and your thumb, and using those two minutes properly.
The move, in three steps
- Touch nothing. No link, no reply, no ringing a number that appeared inside the message. Nothing legitimate expires in ten minutes. If waiting feels dangerous, that feeling was engineered and it is the first signal.
- Paste the message into Claude with the prompt below. Copy the wording, and the sender’s number or address if you can see it, because the giveaway usually lives there. Blot out anything of yours that’s in it. Scammers buy leaked data to sound convincing, so your own postcode appearing is not proof of anything.
- Go in the front door. Type the company’s address yourself, open their app, or ring the number on the back of your card. If the invoice, refund or problem is real, it’s sitting there when you log in.
Step 3 happens whatever comes back from step 2. That is the whole reason this works on the day the checking gets it wrong.
The prompt
This one deliberately does not ask for a verdict. A verdict is a thing you can be wrong about, and a confident wrong verdict is worse than no verdict at all.
Nick this one (save it in your notes app):
You're helping me examine a message I've received before I decide what to do with it. You are gathering signals, not delivering a judgement.
The message, exactly as it arrived (I've blotted my own details):
[PASTE IT]
How it arrived: [text / email / WhatsApp / letter / an attachment I have not opened]
Sender shown as: [the number, address or company name, if you have it]
My context, honestly: [e.g. "I do use this supplier and an invoice is roughly due" or "I've never heard of them"]
Give me:
1. SIGNALS THAT LOOK WRONG. Every one you can find, each in one plain sentence: the wording, the sender address, the link text, the deadline, the payment method, anything off about the format.
2. SIGNALS THAT LOOK NORMAL. Be fair. What in here is consistent with a genuine message from this kind of organisation?
3. WHAT YOU COULD NOT CHECK. List it explicitly: whether the domain is real, whether the account details match the ones on file, whether the sender was hacked, anything that needs the live internet or my records. Do not skip this section.
4. WHAT THIS MESSAGE WANTS ME TO DO, and what would most likely happen if I did.
5. HOW TO VERIFY IT MYSELF, in numbered steps, using nothing from the message. Name the exact place I should look.
6. Finish with one sentence I could say to whoever else needs to know, stating what I found and what I'm doing next.
Rules: British English, plain and blunt. Do NOT tell me whether this is or isn't a scam. You cannot see the sender's real domain, my account, or the person behind it, so a verdict from you would be a guess wearing a suit. Never call something safe because it looks professional. If a signal is ambiguous, say ambiguous.
Ask me up to three questions before you start.The section that earns its place is number 3. Everything else is pattern-spotting you could half do yourself. “I could not check whether this bank account matches the one on your previous invoices” is the line that sends you to the invoice, which is where the answer actually is.
The version for when it’s 9pm
The short one:
Signals only, no verdict. What looks wrong in this message, what looks normal, what you could not check, and how I'd verify it myself without touching anything in it: [PASTE IT]A worked example
Say this arrives on a Tuesday morning:
“Invoice 4471 from [supplier you use] is now 14 days overdue. Please settle today to avoid a late payment charge. Updated bank details below.”
The signals that look wrong: a supplier changing bank details inside an email, urgency attached to a payment, an invoice number you don’t recognise. The signals that look normal: you do use them, you are probably due an invoice, the wording is competent.
And the section that saves you: it cannot check whether those bank details match the ones you’ve paid before. So you open your own records, compare, and if they differ you ring the supplier on the number you already had. Not the one in the email.
That’s a change-of-bank-details fraud handled in four minutes, without anyone having to be clever.
While you’re there
Forward scam texts to 7726 (free, goes to your network) and scam emails to report@phishing.gov.uk. Thirty seconds, and it genuinely helps get these shut down.
The honest bit
This reduces the risk, it doesn’t remove it. A message sent from a genuinely hacked account will show almost no wrong signals, because it is a real account. Step 3 covers you anyway.
It can’t judge a live phone call. Hang up, wait, ring back on a number you found yourself.
It will sometimes flag real messages. That costs you two minutes of checking directly, which you were doing regardless.
Tonight
Save the short prompt in your notes app now, while you’re thinking about it. The whole defence is having it ready before the message arrives, because the message is timed for the moment you aren’t.
Where this goes next. That’s one habit that protects one afternoon. The Claude Kickstart sets Claude up around your actual trade, with five real jobs handed over properly. £47, one weekend.