Be suspicious of messages that create unusual urgency, request passwords or MFA codes, change bank details, or contain unexpected links and attachments.

Check the real sender address.

When unsure, do not click anything. Contact the sender through a trusted method or ask IT support to verify the message.