What phishing is
Phishing is an attempt to trick someone into giving up information or taking an action by pretending to be a trusted sender: a bank, an employer, a delivery service, a government office or a friend. The goal is usually one of three things: collect a login, get a payment, or get the victim to open something that installs malware.
It works because it targets attention and trust rather than technology. A message that arrives when you are busy, mentions something plausible and asks for a quick action can catch anyone. Being caught out is not a sign of stupidity.
Forms it takes
- Email phishing. The classic form: a message with a link to a fake sign-in page or an attachment.
- Spear phishing. A message written for one person or organization, using real names and context. These are much harder to spot than mass mailings.
- Smishing. Phishing by text message, often about a parcel, a toll, an account problem or a refund.
- Vishing. Phone calls from someone claiming to be your bank, a technology support agent or a tax authority. Caller ID can be faked.
- Business email compromise. A message that appears to come from a senior colleague or supplier, asking for an urgent payment or changed bank details.
- Messaging and social media phishing. Direct messages from a hacked friend’s account, or fake support accounts that respond to public complaints.
- QR code phishing. A code that leads to a fake page, since the destination is hidden until scanned.
Many of these are variants of online scams, and the same pattern of urgency and pressure runs through them all.
Warning signs
No single sign is conclusive, and well-made messages may have none of them. Several together should slow you down.
Urgency or threat. “Your account will be closed in 24 hours” or “Act now to avoid a fine” is designed to stop you thinking. Legitimate organizations do sometimes send time-limited notices, but they rarely demand immediate action through a link.
An unexpected request. A message about an order you did not place, a prize you did not enter, or a document you were not expecting deserves extra suspicion.
A mismatch in the sender. The display name may look right while the actual address is different or slightly misspelled. Replies might go to a different address than the one the message appeared to come from.
Links that do not match. On a computer, hovering over a link usually reveals the real destination. Look at the domain, which is the part just before the first single slash. A real company’s domain is not “company.example-security-check.com”, where the true domain is the last part before the slash. Shortened links hide this entirely.
Requests for sensitive details. Banks and reputable services generally do not ask you to send passwords, full card numbers or one-time codes by email or text.
Generic greetings or odd wording. Careless messages often say “Dear customer”, though modern messages written with AI help may be fluent and polished, so good grammar is no longer a reliable sign of safety.
Unusual attachments. Be careful with unexpected files, especially compressed archives, or documents that ask you to enable macros or editing.
Payment by unusual means. Requests for gift cards, cryptocurrency or transfers to a new account are red flags.
What to do with a suspicious message
- Do not click or reply. Do not call numbers in the message either.
- Check through a separate route. Open the official app or type the organization’s address yourself, or call the number printed on a card or on the official website.
- Ask the apparent sender. For a message from a colleague or relative, contact them by another method.
- Report it. Most email services and workplaces have a “report phishing” option. At work, tell the security or IT team, since others may have received the same message.
- Delete it once reported.
If you already clicked
Take a breath. Clicking a link alone often does little, but acting quickly helps in the cases where it matters. The right steps depend on what happened.
You only opened the message or clicked a link, and nothing else happened. Close the page, and run a scan with your device’s security software if you are concerned. Keep your device updated, because attacks that need nothing more than a click usually depend on unpatched software.
You entered a password. Change it right away on the real site, and on any other site where you used the same password. Turn on two-factor authentication. Review recent account activity and check for new forwarding rules or recovery details that you did not set. Sign out of other sessions if the service offers that.
You entered card or bank details. Contact your bank or card provider by the number on the card. They can block the card, review transactions and advise on next steps. Check statements for a while.
You sent money. Contact your bank immediately. Speed matters because it can sometimes be possible to halt or recall a payment, though success is not guaranteed. Consider reporting to the relevant consumer protection or police body in your country.
You opened an attachment or installed something. Disconnect the device from the network, run a security scan, and ask for help from IT or a trusted technician. At work, report it at once rather than trying to hide it; early reports let the team contain a problem before it spreads. In serious cases, reinstalling the system may be the safest route.
You shared identity details. Watch for misuse, and look into your country’s options for placing alerts or freezes on credit files.
Afterward, it can help to check whether your email address appears in known data breaches, since attackers often use that information to make messages convincing.
Habits that make phishing less effective
- Use password managers. They fill credentials only on the matching domain, which can quietly expose a fake site when nothing autofills.
- Turn on two-factor authentication, and where possible use passkeys or hardware keys, which resist phishing better than texted codes.
- Keep systems and browsers updated.
- Slow down for anything urgent involving money or credentials.
- Keep your public personal details limited; attackers use them to craft convincing messages.
Organizations add technical filters, such as checks on whether the sender is authorized to use a domain, link scanning and attachment sandboxing. These catch much but not all, so human judgment remains part of the defense.
Keeping perspective
Phishing will probably remain common because it is cheap and sometimes works. No filter or habit gives complete protection, but a pause, a second channel and strong sign-in settings can turn a near miss into a harmless one.