How do you verify that "official" help or mod messages are legitimate?

Receiving a message that appears to come from Reddit admins, a subreddit's moderators, or a company's official support presence is a common vector for phishing and social engineering on the platform. Verification requires checking a small number of objective indicators rather than relying on the message's claimed authority. The clearest indicator of a legitimate Reddit administrator message is a visual marker: messages from Reddit's verified administrative accounts appear with a distinctive formatting difference — typically including a bold red [A] badge next to the account name in older Reddit interfaces, or a verified indicator in newer contexts. Reddit's administrators will not contact you through an account that lacks this credential marking. If a message claiming to be from "Reddit Safety" or "Reddit Trust and Safety" comes from an account without this badge, it is not a Reddit staff message. For subreddit moderators, legitimate modmail messages come through Reddit's official modmail system and appear in your inbox labeled as a modmail conversation from a specific subreddit. Check whether the subreddit named in the message is one you actually participate in, and verify that the account messaging you is actually listed as a moderator of that subreddit. You can check the moderator list by visiting the subreddit's "About" or "Moderators" page. A message claiming to be from "the moderators of r/SomeSub" from an account not on that subreddit's mod list is fraudulent. For company support impersonation, the key verification step is never clicking links in the message and instead navigating directly to the company's official website through your browser to access their support system. Legitimate support does not require you to log in through a link sent in a DM. Any message that creates urgency ("your account will be suspended in 24 hours unless you verify"), requests credentials, or asks you to perform account actions through an external link should be treated as a phishing attempt until independently verified.