Free Tool
Pause Before You Click Checklist
Most online harm starts with one click — a link in a message, a button on a pop-up, an attachment that looks urgent. This checklist gives you five questions to ask before you click anything, in a one-page format you can print and keep by the computer. Pick who it is for — an older adult, a parent, or a teenager — and the wording fits them.
Print it and keep it by the computer. The checklist is designed to be printed on one page. Five questions, asked before every click, catch most phishing and scams — not because the questions are clever, but because pausing is what the scammer is trying to prevent.
What this tool does
Scams work by speed. A message says your account will close in an hour, a parcel will be returned today, a prize expires at midnight — and the rush stops you from thinking. The defence is not cleverness but a pause: five questions, asked in order, that take about a minute and catch the tricks that speed is hiding. Was I expecting this message? Does the sender match the company? Does the link go where it claims to? Is it asking for a password, money or a code? And would I be comfortable explaining this click to someone I trust?
This tool builds that checklist for the person who will use it. Pick an audience — an older adult, a parent, or a teenager — and the wording and the examples change to fit: older adults get the bank-call and grandchild scams, parents get the school-fee and delivery scams, teenagers get the free-items and account-sharing traps. The checklist itself is the same five questions, because the pause is the same whatever your age. Print it, stick it next to the computer, and use it every time a message asks you to click.
The checklist is the printable companion to the phishing guides on this site. It is based on the same approach as the best existing printable — a warm, non-commercial pause-before-you-click list — extended to three audiences instead of one, and built so it can be printed from this page in one click.
Try it
Pick who the checklist is for, then print it or download it as a text file.
Waiting. Pick an audience and press Show my checklist.
How it works
The checklist works because it interrupts the scammer's timetable. A phishing message is designed to be acted on in seconds, before the reader has time to think. Five questions, read aloud or in your head, take a minute — and a minute is enough for the inconsistencies to appear: a sender address that does not match the company, a link that does not go where it claims, a request for a password that a real company would never make. The questions are deliberately simple, so they can be asked by anyone, of any message, without technical knowledge.
The five questions are: was I expecting this message; does the sender's address match the company it claims to be from; does the link go where it claims to go; is it asking me for a password, money, a code or a gift card; and would I be comfortable explaining this click to someone I trust? A no to the first, a mismatch on the second or third, a yes to the fourth, or a hesitation on the fifth is a reason to stop. Any one of them is enough: you do not need to be sure it is a scam, you only need to be unsure that it is genuine, and then to check through a channel you trust — the company's app, or a number you already have.
The audience picker changes the wording and the examples, because a checklist that sounds like it was written for someone else is a checklist that gets ignored. Older adults get the bank and grandchild scams in plain, respectful language. Parents get the school and delivery messages that arrive during the busiest part of the day. Teenagers get the free-items and account traps in language that does not lecture. The five questions stay the same — only the voice changes.
Limitations
A checklist helps you pause, but it cannot guarantee a message is safe. Some phishing is well-made enough that it passes all five questions — a message from a compromised account you genuinely know, or a cloned website with a near-identical address. The checklist raises the bar; it does not remove the risk. When in doubt, the safe move is always the same: do not click, and check through a channel you trust.
- The checklist is a habit, not a test. Its value comes from using it every time, not from reading it once.
- It covers messages that ask you to click. It does not cover phone calls, which need their own rule: hang up, and call the company back on a number you already trust.
- Nothing here is stored or sent. The checklist is built in your browser, and it is gone when you close the page unless you print or download it.
Examples
Example 1 — the delivery text (older adult). A text says a parcel is held and asks you to tap a link to pay a small fee. Question one: were you expecting a parcel? No. Question two: is the sender the delivery company, or an unknown number? Unknown. That is two reasons to stop. Check the tracking number on the delivery company's own website instead — never through the link.
Example 2 — the school-fee email (parent). An email says the school trip fee is overdue and asks you to pay through a link today. Question four: is it asking for money? Yes. Question five: would you be comfortable explaining this click to the school? Hesitate, and stop. Call the school on its real number and ask whether the fee is due.
Example 3 — the free game items (teenager). A site offers free game items if you log in with your account. Question three: does the link go where it claims? It goes to a site you have never heard of, not the game's official site. Question four: is it asking for a password? Yes. Two reasons to stop — and the account stays yours.
Frequently asked questions
What is the pause-before-you-click rule?
Five questions, asked before you click a link or open an attachment: was I expecting this message, does the sender match the company, does the link go where it claims, is it asking for a password or money, and would I be comfortable explaining this click to someone I trust? Any doubt is a reason to stop.
Why does pausing help against scams?
Because scams work by speed. A message that creates urgency — act now or lose your account — is designed to stop you thinking. A minute of questions is enough for the inconsistencies to appear.
What should I do if a message fails the checklist?
Do not click anything in it. Check through a channel you trust — the company's app, or a number you already have. If it claims to be from a company you use, log in through the app, not the link.
Can a checklist stop all phishing?
No. Some phishing is well-made enough to pass the questions. The checklist catches most of it, and the habit of pausing catches more. But the final rule is always the same: when in doubt, do not click, and check another way.
Can I print this checklist?
Yes — press Print the checklist, or Download as a text file. It is designed for one page, so you can stick it next to the computer where everyone in the household can see it.