Phishing is when someone uses a fake email, text message or phone call to get you to hand over personal information such as passwords, account numbers or ID details. The messages are often convincing, but they usually share the same weak points. These six checks take less than a minute and catch most of them.
Six checks before you click
- Were you expecting it? A password reset you did not ask for, a delivery you did not order or an invoice from a company you do not use are all reasons to stop.
- Is it urgent or too good to be true? Threats of account closure, deadlines of a few hours and surprise prizes are designed to make you act before you think.
- Look at the real sender address. The display name can say anything. Check the actual email address, and be wary of small differences such as an extra letter or an unusual domain.
- Check where a link really goes. On a computer, hover over the link without clicking and read the address that appears. On a phone, press and hold the link to preview it.
- Be careful with attachments. Do not open files you did not expect, especially archives or documents that ask you to enable macros or editing.
- Notice what it asks for. Legitimate companies do not ask you to send a password, a verification code or card details by email or text.
Poor spelling and awkward wording can be a sign, but do not rely on them: well-written phishing is common. The first two checks, an unexpected message and a sense of urgency, are the most reliable.
What to do with a suspicious message
- Do not click links, open attachments or reply.
- If it claims to be from a company you use, open the company’s website by typing its address yourself, or use its official app, and check your account there.
- Report it. In the United States you can report phishing to the Federal Trade Commission at reportfraud.ftc.gov; most email providers also have a Report phishing option in the message menu, and a workplace IT team usually wants to know about it too.
- Delete the message.
If you already clicked or replied
Acting quickly limits the damage. If you entered a password on a fake page, change it right away on the real site, and anywhere else you used the same password. Turn on two-factor authentication for important accounts, check recent activity for anything you do not recognize, and contact your bank immediately if you shared card or account details. If you opened an attachment or installed something, update your security software and run a full scan.
Make phishing less likely to work
Use a unique password for every account, ideally stored in a password manager, because a manager will usually refuse to fill in a password on a fake site. Keep your devices and apps updated, and enable two-factor authentication wherever it is offered. These habits matter more than any single trick for spotting a fake.
Source
This guide follows the general advice of the U.S. Federal Trade Commission: How to Recognize and Avoid Phishing Scams.
