An older man with a gray beard sitting down and looking at a tablet.

It’s important that you understand what is safe and not safe when processing email in your inbox.

It’s safe to:

  • Open and read an email
  • Preview an email in your inbox
  • Delete or ignore an email
  • Suspect a phishing email
  • Verify unexpected requests through a trusted communication channel before taking action, especially if the message involves sensitive information, financial transactions or account access.

If something seems suspicious, it's not safe to:

  • Open attachments or click on links
  • Preview an attachment or link in your inbox — that’s just like opening it
  • Reply to or provide information back to the sender
  • Approve unexpected multi-factor authentication (MFA) requests or share one-time verification codes with anyone.

Ask yourself these questions when reviewing your inbox

  • Is it expected? If you’re not expecting an email, trust your gut and report it. Even if an email appears legitimate, be cautious of unexpected requests involving passwords, account changes, financial transactions or sensitive information.
  • Do you know the sender? ​​​​​​​If not, try to verify the sender using another method. Remember that cybercriminals sometimes gain access to legitimate email accounts. Even if you recognize the sender, verify unusual or unexpected requests through another trusted communication method. If it doesn’t check out, it could be suspect.
  • Do I need to respond now? ​​Nope! Pump the brakes and take your time. If it doesn’t feel right to you, it probably isn’t. Be especially cautious of messages that create urgency, pressure you to act immediately or discourage you from independently verifying the request.
  • Does the request make sense? Unexpected requests for passwords, MFA codes, gift card purchases, wire transfers, payment changes or confidential information should be treated with caution and verified before proceeding.
  • Is there a QR code or unexpected link? Cybercriminals increasingly use QR codes, shortened URLs and AI-generated content to direct users to fraudulent websites. Verify the destination before interacting with links or scanning codes.