An unexpected message asking for urgent payment, a password reset or a one-time code deserves a pause even when its logo looks familiar.
Examine the request
Check the sender address, unusual wording and whether the request matches something you expected. A display name is easy to imitate, and polished spelling does not prove a message is genuine.
Verify through another route
Do not use a link or telephone number from the suspicious message. Open the organisation’s official app or enter its known web address yourself. For an invoice, use a supplier contact number you already trust.
If you responded
If you entered a password, change it on the real service and review your account security. If you downloaded a file, stop opening it, run a security scan and inform your workplace IT team where relevant.
Further reading: NCSC: spotting scams.