How to Spot a Phishing Message

Phishing is a trick. Someone sends a message that looks like it comes from a company, a coworker or a government office, and tries to make you do something that helps them: click a link, open a file, share a password or send money. The word is a play on "fishing". The message is the bait, and you are the fish.

You do not need technical skill to avoid most phishing. You need a habit: pause, check, then act. This entry teaches that habit step by step and lists the warning signs that appear again and again.

Where phishing shows up

Phishing is not only email. The same trick appears on several channels:

Scammers also hide fake links behind QR codes on flyers or in messages. Treat a code like a link and check where it leads before you enter anything.

A more targeted version of phishing, called spear phishing, uses details about you, such as your name, your job or a real project, to look more believable. Because it is personal, it is harder to spot, so the habits below matter even more.

The common warning signs

No single sign proves a message is fake, and no sign is needed for it to be fake. Look for a pattern.

• Urgency or fear. "Your account will be closed in 24 hours." Scammers want you to act before you think.
• An unexpected request. You did not order anything, but you are asked to confirm an order. You did not apply for anything, but you are asked to "verify" it.
• A sender address that is slightly off. The display name may say "Support", but the address behind it belongs to a different domain, or uses a look-alike spelling.
• A link that goes somewhere else. The text of a link can say one thing while the real destination is another. On a computer you can hover over a link to see where it leads. On a phone you can usually press and hold.
• A request for secrets. Real companies do not ask for your password, a one-time code or your full card details by message.
• Unusual payment methods. Gift cards, wire transfers and cryptocurrency are favorites because they are hard to reverse.
• An attachment you did not expect. Be especially careful with files that ask you to "enable macros" or "enable content".
• Generic greetings and clumsy wording. "Dear customer" is a clue, but good phishing can be well written, so do not rely on spelling mistakes alone.

A five-step check before you click

1. Stop. Do not click, open the file or reply. Taking ten seconds is the single most useful step.
2. Ask who is really writing. Does this sender normally contact you this way? Does the address match the organization?
3. Look at the link without opening it. Hover or press and hold. If the address is not what you expect, do not use it.
4. Go around the message. Open the company's app, or type its address yourself, and check whether the same notice appears there. Or call the number printed on your card or on the official website, not the number in the message.
5. Ask someone. At work, send the message to your IT or security contact. At home, ask a person you trust. A quick question costs nothing.

A worked example

Imagine this text arrives: "Your parcel could not be delivered. Pay a 1.99 fee to reschedule: short-link.example".

Walking through the check:

• You were not expecting a parcel, or you were, which is exactly why the trick works. Either way, this is a possible message, not a proven one.
• The text creates pressure and asks for a small payment, which is a common way to collect card details.
• The link uses a shortened address, so you cannot see where it leads.
• The safe path is to ignore the link. Open the courier's real app or website, type your tracking number there, and see whether there is a real problem.

You never needed to decide whether the text was fake. You only needed to not use the text to reach the real service.

What to do if you clicked or replied

Mistakes happen to careful people, and acting quickly limits the damage.

1. Do not enter anything more. If a page asks for a password or code, close it.
2. Change the password of the affected account from a different, trusted device. If you reused that password anywhere else, change it there too. Strong Passwords and Password Managers explains how to make that easier.
3. Turn on two-step sign-in (also called two-factor authentication) for the account if it is available.
4. Tell your IT team if the device or the account is from work. Report quickly; people who report early are helping, not getting in trouble.
5. Watch your accounts for charges or sign-ins you do not recognize, and contact your bank if you shared card details.
6. Report the message. In the United States, the FTC accepts reports at ReportFraud.ftc.gov, and you can forward phishing emails to [email protected]. Check each organization's page for the current instructions.

Common mistakes

• Trusting the display name. Anyone can type any name into that field. Look at the address behind it.
• Believing a message because it has a logo. Logos are easy to copy.
• Checking only the first line of a link. Scammers often put a real-looking name at the start of a longer address.
• Calling the number in the message. Use a number you already trust or have looked up yourself.
• Feeling embarrassed and staying quiet. Silence helps the scammer. Reporting helps everyone.

FAQ

Can I be affected just by opening an email?

Opening a plain message is far less risky than clicking a link or opening an attachment. Still, avoid interacting with a message you do not trust, and keep your mail app and system updated.

Are phishing messages always badly written?

No. Tools make it easy to write clean, convincing text. Judge the request and the link, not just the language.

Why do they ask for a "verification code"?

Many services send you a one-time code to prove it is you. A scammer who is trying to sign in as you may ask you to read that code to them. Never share it with anyone.

Is it safe to unsubscribe from a suspicious email?

Usually it is better not to click anything in it. Mark the message as spam or phishing in your mail app instead.

Where can I learn more about staying safe?

Read the other entries in the Security Basics area. Two habits cover a lot of ground: use a different strong password for each account, and turn on two-step sign-in wherever it is offered.