Messages from unknown numbers, spelling mistakes, strange links, or requests for OTPs, PINs or bank details should be treated as red flags.