Most scams don’t succeed because someone failed to notice a red flag. They succeed because someone responded before pausing to think about it.
A short pause is often the only thing standing between a normal request and a costly mistake. Knowing exactly what should trigger that pause makes it easier to catch in the moment.
Here are the specific signals worth stopping for, regardless of whether the request comes by email, text, or phone.
The Request Involves Money, Payment, or Banking Changes
Any message involving a payment, invoice, wire transfer, or a change to banking or payment information deserves a pause before action.
This is true even when the request appears to come from a known vendor, a coworker, or a company leader. Financial requests are the most common target for a reason, and a quick verification call costs far less than an incorrect payment.
You’re Being Asked to Act Quickly
Urgency is one of the most common tools used to prevent careful thinking.
A request that emphasizes how fast it needs to happen, or discourages taking time to verify it, should be treated as a reason to slow down rather than speed up. Legitimate requests can almost always tolerate a short delay for confirmation.
The Message Creates Pressure Through Emotion
Some requests are designed to create fear, worry, obligation, or a desire to help quickly, rather than giving you time to evaluate them calmly.
If a message seems to be relying on how it makes you feel rather than what it’s actually asking, that’s worth noticing on its own. A message that makes you anxious enough to act immediately deserves more scrutiny, not less.
You’re Asked to Keep It Quiet or Handle It Personally
A request that asks you to keep something confidential, avoid mentioning it to a coworker or supervisor, or handle it personally without the usual involvement of others is worth stopping for.
Legitimate business requests are rarely dependent on secrecy. Isolation is often intentional, since it removes the chance that someone else would recognize the request as unusual.
The Request Is Slightly Different Than Normal
A familiar request delivered in an unfamiliar way, such as a different tone, an unusual time, or a request routed through a different channel than normal, is worth a second look.
Small deviations from a normal pattern are often the clearest sign that something isn’t right, even when everything else looks correct. This includes requests that arrive outside of normal business hours or from someone who doesn’t usually reach out directly.
You’re Being Asked to Skip a Normal Process
If a request asks you to bypass an approval step, avoid confirming with someone else, or handle something outside the usual process, that request itself is a signal.
Legitimate requests rarely require skipping the steps your business already has in place. If anything, a legitimate request should hold up fine to the normal process being followed.
The Channel Doesn’t Match Who It Claims to Be From
A text from someone who normally emails, a call from a number that doesn’t match a known contact, or a message from a personal account instead of a business one are all reasons to verify before responding.
The channel a message arrives through is part of what should be evaluated, not just its content.
You Weren’t Expecting This Request at All
An invoice for a project you don’t recognize, a password reset you didn’t request, or a message referencing something you have no context for is worth pausing on.
Scams often rely on the recipient assuming they simply forgot about something, rather than questioning whether the message is legitimate in the first place.
Something Feels Off, Even If You Can’t Explain Why
Sometimes a message doesn’t match any specific red flag, but still feels slightly wrong.
That instinct is worth trusting long enough to verify the request independently rather than dismissing the feeling and moving on. Employees who have handled a lot of normal requests often notice when something breaks that pattern, even before they can say exactly why.
What to Do Once You’ve Stopped
Pausing is only useful if it leads to action. Verify the request through a separate, already known contact method, ask a coworker or supervisor before proceeding, and report anything that still feels uncertain.
Employees should never feel like stopping to check is an overreaction, even when the request turns out to be legitimate. A few extra minutes spent confirming a request is a small cost compared to what a wrong guess could turn into.
If your team isn’t sure what to do after they’ve paused, or needs a clear process for reporting and verifying requests like these, RBS IT can help put one in place.
Want more quick ways to keep your team sharp against scams? Sign up for RBS IT Tech Tips.
