How to Spot a Phishing Message Before You Click

Phishing is the practice of sending fake messages that pretend to come from a trusted company or person, in order to steal passwords, money or personal details. It remains one of the most common ways accounts are compromised, because it targets people rather than software. The messages have become more convincing over time, but they still tend to share a set of recognisable warning signs.

Phishing arrives through email, text messages, social media and even phone calls. The format changes, but the goal is always to make you act quickly before you think carefully.

Warning sign 1: Urgency and pressure

Phishing messages often claim that something bad will happen unless you act right away. Your account will be closed, a payment failed, a parcel is stuck, or suspicious activity was detected. Legitimate organisations do send alerts, but they rarely demand immediate action through a link. Pressure is a tactic designed to stop you from checking.

Warning sign 2: A mismatched sender or link

Look closely at the sender’s address, not just the display name. A message that says it is from your bank but comes from a random free email account, or from a domain with a small misspelling, is a red flag. On a computer, hover over a link without clicking to see where it really goes. On a phone, press and hold the link to preview the address. Watch for tricks such as extra words added to a real brand name or unusual endings.

Warning sign 3: Requests for sensitive information

Real companies do not ask you to confirm your full password, PIN or one-time security code by email or text. If a message asks for any of these, treat it as fake. Be especially wary of anyone asking you to read out a code that was just sent to your phone; that code is often the key to your account.

Warning sign 4: Unexpected attachments

Attachments such as invoices, shipping documents or “secure messages” you were not expecting can contain malware or lead to fake login pages. If you were not expecting a file, confirm with the sender through a separate channel before opening it.

Warning sign 5: Something feels slightly off

Generic greetings, odd formatting, a logo that looks stretched or a tone that does not match how the company usually writes can all be clues. That said, modern phishing can be polished and error-free, so do not rely on spelling mistakes alone.

A safer habit: go direct

The single most useful rule is this: never use the link in an unexpected message to log in. Instead, open your browser or the company’s official app and sign in the way you normally do. If there really is a problem with your account, you will see it there. If someone calls claiming to be from your bank, hang up and call the number printed on your card.

Text message scams

Text phishing, sometimes called smishing, often involves fake delivery notices, toll charges or prize claims. Short links make it hard to see the real destination. Delivery companies and toll agencies rarely ask for payment through a text link. Check the official website or app instead, and report the message using your phone’s built-in reporting option.

What to do if you clicked

Mistakes happen, even to careful people. If you clicked a link or entered details on a suspicious page, act quickly:

• Change the password for that account right away, from the official website
• If you reused that password elsewhere, change it on those accounts too
• Turn on two-factor authentication if it is not already enabled
• Contact your bank immediately if you shared card or payment details
• Run a security scan if you downloaded a file
• Watch your accounts for unusual activity over the following weeks

Help others stay safe

Report phishing emails using your email provider’s “report phishing” button, which helps filters catch similar messages. Share examples with older relatives or less tech-confident friends, since a quick conversation is often the best protection. A password manager also helps, because it will not autofill your password on a lookalike website, giving you a useful moment to pause.

Staying safe does not require technical expertise. Slow down, check the sender, go direct rather than clicking, and never share codes. Those habits stop the vast majority of phishing attempts.