Right now
Stay calm. Do not hang up.
Keep the caller talking, write down everything, and get someone else to call 911 while you listen. Most threats turn out to be false, made to disrupt rather than warn. Every one of them gets reported anyway, and what you notice in the next two minutes is what investigators will work from.
By Dan Whelan, founder of New World Survival
Researched from government agencies, university extension services, and other published sources. See our sources
If the threat comes by phone
Your notes are the whole investigation
The federal playbook for a phoned threat fits on one card, and it all serves one purpose: capture everything while the caller is still talking.
While the caller is on the line
Stay calm and keep the caller on the line as long as possible. Signal a coworker or family member to call 911 and alert whoever runs the building. If the phone has a display, copy down the number or letters on it. Write the exact wording of the threat, word for word, and record the call if your phone can. Note the exact time. None of this is politeness toward the caller; every extra second on the line is information.
Source: CISA/DHS Bomb Threat Checklist (2025)
The eight questions to ask
Where is the bomb located? When will it go off? What does it look like? What kind of bomb is it? What will make it explode? Did you place the bomb? Why? What is your name? The caller may answer none of them. Ask anyway. People who intend only to disrupt often hang up when questioned, and people who answer give investigators specifics that can be checked against the building.
Source: CISA/DHS Bomb Threat Checklist (2025)
What to notice
The voice: male or female, estimated age, accent, calm or angry, disguised, slurred, familiar. If it sounds like someone you know, write down who. The background: street noise, machinery, music, a PA system, kitchen sounds, static. The language: coherent or not, profane, well-spoken, or read as if from a script or a recording. These details feel small in the moment and identify callers later.
Source: CISA/DHS Bomb Threat Checklist (2025)
Written, email, or social media
Preserve it. Do not clean it up.
A threat that arrives on paper or on a screen is evidence from the moment it arrives. The instinct to delete it, forward it, or tidy it away is the one to resist.
On paper
Handle the document as little as possible. Note the date, the time, and exactly where it was found. Secure it somewhere it will not be touched, and do not alter it, mark it, or let it circulate.
By email or social media
Do not log out, do not turn the device off, and do not delete anything. Leave the message open, take a screenshot, and copy the message and its subject line. Note the date and time you saw it.
Then report it
At a workplace, school, or church, notify whoever is responsible for the building and call 911. At home or in a small business, you are the one responsible: call 911 directly and follow their direction.
Source: CISA Bomb Threats guidance; CISA/DHS Bomb Threat Checklist (2025)
If you find a suspicious item
Do not touch it. Move away. Call 911.
The three moves
Do not touch, move, or cover the item, no matter how harmless it looks or how strong the urge to check. Move away immediately and direct others to move away with you. Treat it as an emergency: call 911 and describe what you saw and exactly where.
Source: CISA Suspicious Activity and Items; CISA/DHS Checklist
Keep phones and radios back
Do not use cell phones or two-way radios near the item. Make the 911 call from a distance. A suspicious package in the mail has its own short playbook, including washing your hands and the Postal Inspection Service's emergency line, 1-877-876-2455.
Source: CISA/DHS Checklist; U.S. Postal Inspection Service
What counts as suspicious
An item is suspicious when it is out of place and unexplained: a bag abandoned where bags do not get left, a package at a door nobody expected, wires or tape where they make no sense. An ordinary forgotten backpack in a place where people forget backpacks is usually just that. Context decides, and when you are unsure, the answer is the same three moves above.
Source: CISA Suspicious Activity and Items
Evacuate or stay
The assessment is not your job
Whether a building locks down, searches, or evacuates is a judgment call made by trained decision makers weighing how specific and realistic the threat is. A vague threat usually means a lockdown and a check for anything out of place; a specific, realistic one means evacuation. Your job is the accurate report and calm compliance with whatever is decided. Leaving on your own through an unsearched exit can be worse than staying put.
If the threat names your home, the decision maker is you, and the call is simple: dial 911, tell them everything you wrote down, and do what they say.
Source: CISA Bomb Threats guidance
Before it ever happens
One page of preparation
Print the checklist and put it near the phone
CISA publishes the one-page Bomb Threat Checklist free. Print a few copies and keep one at the front desk, in the church office, or wherever calls get answered. Nobody remembers eight questions under stress; the person holding the card does not have to.
Source: CISA, accessed October 25, 2026
Know who decides in your building
Every workplace, school, and house of worship should be able to answer one question before anything happens: who makes the lockdown-or-evacuate call? If nobody knows, that is the gap to close this week. CISA's bombing prevention pages carry free planning guides and short courses for exactly this.
Source: CISA Office for Bombing Prevention
Keep going
Go deeper on what matters next
Sources: CISA/DHS Bomb Threat Checklist (August 2025 edition), CISA Bomb Threats guidance (Office for Bombing Prevention), CISA Suspicious Activity and Items, U.S. Postal Inspection Service Suspicious Mail. All safety claims verified against primary sources. Last reviewed October 25, 2026.
This guide is not professional security or emergency management advice. It is a plain-language starting point, written to be read before anything happens.