In class, we used suspicious messages to practice pausing before reacting. The useful question was what the message asked someone to do, not whether they could tell who or what had written it.
Unexpected links and requests for account information should be checked independently. Open the service through its usual app or a known website, rather than following the message. A convincing display name or familiar wording does not establish who sent it.
In practice
- Do not share a sign-in code in response to a message.
- Verify the request through a contact method you already trust.