Hacker News Reader

As long as it doesn't have any links to click or try to force you to login to something, it just sounds like information to me.

If my bank sent me something about Credit Card fraud I would be very skeptical if it had a big "CLICK HERE TO LOGIN" type of thing.

But if it was just info, and maybe ended with "Contact your local branch to learn more", but no links, no phone numbers, etc. I would be less skeptical.

View on HN

This is, I think, a valuable heuristic. Anything but the most complex and long-term scam always includes some call to action, nearly always URGENT and IMMEDIATE (so as not to give you a chance to think about it or research it).

A notification that is ONLY a notification about something is very unlikely to be malicious (though could certainly be erroneous). My bank will send me a concerning email or SMS about suspicious activity that needs to be reviewed or confirmed, but because they know it's a vector for attack their specifically ask you to call them at their published number listed on your card.

Reply on news.ycombinator.com