Phishing is when someone pretends to be a company, a bank or a person you know in order to trick you into handing over passwords, card details or money. It usually arrives as an email, and the best ones look very convincing. The good news is that most phishing messages share a few warning signs. Learning to notice them is one of the most useful online safety habits you can build.
1. The sender address doesn’t quite match
The name shown in your inbox can say anything, so look at the actual address behind it. Scammers often use lookalike domains, such as a company name with an extra letter, a hyphen or a different ending. If the address looks odd, treat the message with suspicion.
2. It creates urgency or fear
Messages that say your account will be closed today, a payment has failed, or you must act within hours are designed to make you panic and click without thinking. Real organisations rarely demand instant action by email. Take a breath and verify through another route.
3. It asks for sensitive information
Genuine companies do not ask you to send your password, full card number, PIN or one-time code in reply to an email. If a message asks for any of these, it is almost certainly a scam.
4. The link goes somewhere different from what it says
On a computer, you can hover your mouse over a link without clicking to see the real web address. On a phone, you can usually press and hold the link to preview it. If the address doesn’t match the company it claims to be from, don’t click.
5. There is an unexpected attachment
Be cautious with attachments you weren’t expecting, especially invoices, delivery notices and documents that ask you to enable macros or editing. If you aren’t sure, contact the sender through a different channel before opening it.
6. The greeting is generic
Messages that open with “Dear customer” or “Dear user” may have been sent to thousands of people at once. This is not proof on its own, since some scammers do use your real name, but it is a useful clue.
7. It sounds too good to be true
Surprise prizes, unexpected refunds, easy job offers and big discounts from companies you have never dealt with are classic bait. If you didn’t enter a contest, you probably haven’t won one.
8. Something just feels off
Spelling mistakes and awkward wording can be a sign, but don’t rely on them alone. Modern phishing can be polished and well written, and a clean-looking email is not automatically safe. If your instinct says something is wrong, pause and check.
How to check safely
- Don’t use the links or phone numbers in the message. Open your browser and type the official website address yourself, or use the app you already have installed.
- Contact the organisation using details from its official website or from a card or statement you already have.
- If it claims to be from someone you know, ask them through a different channel, such as a phone call or another messaging app.
- When in doubt, don’t click and don’t reply.
What to do if you receive one
- Report it as phishing or spam in your email app, which helps protect other people too.
- If your workplace or school has a security team, forward the message to them as instructed.
- Delete the message once you have reported it.
What to do if you already clicked or replied
- Don’t enter any more information on the page.
- If you entered a password, change it right away on the real website, and on any other site where you used the same one.
- Turn on two-factor authentication for your important accounts.
- If you shared card or bank details, contact your bank or card provider immediately.
- Keep an eye on your accounts for activity you don’t recognise.
The bottom line
Phishing works by rushing you. Slowing down, checking the sender, and going to the official website yourself will stop most attempts. Nobody gets every one right, so it also helps to use strong, unique passwords and two-factor authentication, so that a single mistake does less damage.