How to Protect Yourself
Remember that companies generally don’t contact you to ask for your username or password.

Don’t click on anything in an unsolicited email or text message. Look up the company’s phone number on your own (don’t use the one a potential scammer is providing), and call the company to ask if the request is legitimate.

Carefully examine the email address, URL, and spelling used in any correspondence. Scammers use slight differences to trick your eye and gain your trust.

Be careful what you download. Never open an email attachment from someone you don’t know and be wary of email attachments forwarded to you.

Set up two-factor (or multi-factor) authentication on any account that allows it, and never disable it.

Be careful with what information you share online or on social media. By openly sharing things like pet names, schools you attended, family members, and your birthday, you can give a scammer all the information they need to guess your password or answer your security questions.

Source: Federal Bureau of Investigation:
https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-scams-and-crimes/spoofing-and-phishing

Don’t click on suspicious links

Phishing or spam emails may contain links or attachments that include malicious code.

Do not forward these emails to others, even if attempting to confirm if it is real.

Verify the Sender

Even if you recognize the sender’s name, you should verify that you recognize the sender’s email address.

Remain cautious—even known email addresses can be spoofed or hacked.

Confirm through safe channels

If you are unsure if an email is legitimate or not, reach out to the sender using another safe channel.

Do not reply to the email or call a phone number included in that email.