Slow down
Urgency, threats to suspend an account and unusual promises are reasons to check. None proves fraud on its own, but each warrants independent verification.
Check the destination
Open the service through its known address or a bookmark. Avoid signing in through an unexpected link. Do not enable macros to read an unsolicited document.
If you entered credentials
Change the password from a trusted device, revoke sessions and notify your administrator. Check email forwarding rules and account recovery methods. Preserve the message for investigation.
