A countdown, a threat, "act now." Real companies don't put a timer on your panic.
One or two characters off the real address. Always read it slowly.
It asks for your password on their site — not the real app. That's the trap.
Don't tap. The rush is the whole trick.
Go there yourself. Never through their link.
A parent, teacher, or friend. Out loud beats alone.
Mark as junk/spam, then delete it.