In this article
There is no useful confidence score for a message when the crucial evidence is missing. A review should tell you what to verify next, not label the sender “safe.”
Begin with the requested action
A message about work can ask you to read, respond, download, sign in or disclose information. These are different levels of exposure. Before arguing about the sender’s spelling or tone, identify what following the request would actually do.
If it would disclose a password, verification code, identity document or financial information through a message, pause. If it asks for software installation or a new app permission, pause that action too. A company name in the message does not answer why that destination or permission is needed.
The FTC advises contacting an organization through a phone number or website you already know is genuine rather than contact details supplied in a suspicious message. That breaks the circular test in which the same message both makes the claim and provides its own proof.
Three weak signals often mistaken for proof
- The message knows something about work. Relevant context can make a message persuasive. It does not authenticate the sender or establish who can receive the requested information.
- The page looks familiar. A logo or layout can be copied. Visual resemblance cannot establish that a destination is the organization’s actual service.
- The message arrived at a plausible time. Timing can fit a legitimate workflow or simply be a coincidence. It cannot settle an identity question.
Conversely, unfamiliar wording alone is not proof of fraud. A legitimate message can be poorly written, and a malicious one can be polished. Focus on evidence you can verify separately.
A worked case: the urgent shift message
FICTIONAL CASE
A worker receives a text offering a shift. A second message says the account will lose access unless the worker sends a verification code. The second request changes the risk, even if the first message described a real opportunity.
Next check: stop the disclosure, reach the known employer route independently and ask whether that account action is expected. Do not send a code to prove ownership to the person who asked for it. The first plausible detail does not validate every subsequent instruction.
This case is not a report of an actual LISA incident or a claim about the service’s message format. It illustrates why authentication and transaction context need separate evidence.
If you already acted
Do not compound the exposure by posting screenshots or codes in a public discussion. Contact your employer’s established security or support channel using independently known details. State the type of action you took and when, then follow its secure reporting process. This publication cannot examine the account, revoke access or determine whether compromise occurred.
The FTC’s guide has separate advice for possible identity-information exposure and for a potentially harmful download. Follow the guidance matching what happened rather than applying a generic checklist. A closed browser tab does not establish that a disclosed secret or downloaded file is no longer a concern.
What to keep for the right recipient
A useful private report can identify the communication channel, approximate time, requested action and whether you clicked, downloaded or disclosed anything. An authorized investigator may need more, but that does not make the full message appropriate for a public tool or an unrelated editorial inbox.
The message-evidence checklist accepts categories only. It does not inspect links, scan attachments, authenticate senders or certify safety. Its purpose is to make the next question specific enough to answer through a trusted route.
SOURCE NOTES / OCTOBER 16, 2026
Evidence behind this article
Public-source reporting and editorial analysis. No private account was inspected. Worked cases are fictional.
- FTC: How To Recognize and Avoid Phishing Scams — General guidance on suspicious messages, independent verification and response after possible exposure.