Spotting Phishing Messages Before You Click
Phishing is the practice of tricking people into revealing passwords, financial details or other sensitive information by pretending to be someone trustworthy. The messages arrive by email, text, phone call or social media, and they have become harder to spot as scammers improve their presentation. The good news is that a few habits stop most attempts.
How phishing works
The attacker creates a sense of urgency or fear, or promises something attractive, in order to push you into acting without thinking. The message might claim your account is suspended, a parcel needs a fee, or a payment has failed. It then directs you to a fake website that looks genuine, or asks you to open an attachment, reply with details or call a number.
Common warning signs
- Urgency: Threats such as “act within 24 hours or lose access”.
- Generic greetings: “Dear customer” from a company that normally uses your name.
- Odd sender details: Addresses that look similar to the real one but contain small differences.
- Unexpected requests: Asking for passwords, codes or payment details.
- Suspicious links: Web addresses that do not match the organisation’s real site.
- Poor language: Though many modern messages are well written, errors still appear.
Check links without clicking
On a computer, hovering over a link shows the destination address. On a phone, pressing and holding may display it. If the address looks unfamiliar or strangely long, do not open it. A safer approach is to type the organisation’s address yourself or use a saved bookmark or its official app.
Be wary of attachments
Unexpected attachments, especially from unfamiliar senders, can carry harmful software. Even a known sender’s account may be compromised. If a colleague sends a surprising file, confirm through another channel such as a phone call.
Voice and text variants
Phone-based scams may pretend to be banks, tax offices or technical support. Text messages might claim to be delivery companies. A genuine organisation will not usually ask you to share full passwords or one-time codes. If in doubt, hang up and call the number printed on an official card or website.
What to do if you are unsure
- Do not click, reply or call the number in the message.
- Contact the organisation through a verified route.
- Report the message using the reporting feature in your email service, or to the relevant national authority.
- Delete it.
If you did click
Do not panic. If you entered a password, change it immediately on the real site and on any other account where you used it. Turn on two-step verification. If you shared financial information, contact your bank straight away. Run a security scan on your device if you opened an attachment, and monitor your accounts for strange activity.
Build protective habits
- Use unique passwords and two-step verification, so a stolen password alone is not enough.
- Keep your software updated.
- Talk with family members, particularly older relatives and teenagers, about common scams.
- Slow down: a pause of thirty seconds defeats most pressure tactics.
Business and workplace variations
At work, scammers may impersonate a manager asking for an urgent payment or a supplier announcing new bank details. Establish a habit of confirming financial requests through a second channel, such as a call to a known number. Many organisations have a procedure for reporting suspicious messages, and using it protects colleagues as well as you.
Scammers rely on speed and emotion. By staying calm and verifying independently, you take away their biggest advantage.