What phishing is
Phishing is an attempt to trick you into handing over something valuable by pretending to be someone you trust. The target might be a password, a payment card number, a one-time code, or simply a click that installs unwanted software. The word is often used for email, but the same approach appears in texts, calls and social media messages.
Phishing emails range from clumsy to very polished. Because it costs almost nothing to send thousands of messages, even a low success rate is worthwhile for the sender. The most useful skill is not memorizing examples but knowing which general clues to check.
Clue one: the sender does not quite add up
Start with who the message says it is from, and compare that with where it actually comes from.
- The display name versus the address. Most email programs show a friendly name, such as a company or a colleague, but the real address sits behind it. Look at the full address. If a message from a “bank” comes from an unrelated or random-looking domain, that is a warning.
- Look-alike domains. Addresses can differ from the real one by a letter, an extra word or a different ending. Read the part after the “@” slowly.
- Free email for official business. A message claiming to be from a large organization but sent from a free personal mail account is suspicious, though some small businesses do use them.
- A familiar name in an unfamiliar place. If a coworker or relative suddenly emails from a new address, or with a request that does not sound like them, their account may have been taken over or their name copied. Check through another channel.
Be aware that senders can sometimes be faked more convincingly, and that a correct-looking address does not prove a message is safe. Treat sender checks as one clue among several.
Clue two: urgency, fear or reward
Phishing messages try to make you act before you think. Common emotional levers include:
- Fear: “Your account will be closed,” “unusual sign-in detected,” “payment failed.”
- Urgency: “Within 24 hours,” “final notice,” “act now.”
- Reward: “You have won,” “claim your refund,” “you are owed a payment.”
- Authority: A message that appears to come from a manager, an agency or a technology provider and demands something immediately.
Real organizations do send alerts and deadlines. The difference is that they usually allow you to verify the issue by signing in through their normal website or app, rather than through a link in the message.
Clue three: links and attachments
Links are the most common doorway.
- Hover before you click. On a computer, moving your pointer over a link typically shows its true destination in a corner of the window. On a phone, a long press may show it. If the destination does not match the organization named, do not use it.
- Shortened or hidden links. Links that hide their destination make checking harder. Be extra careful with them.
- Login pages that arrive by link. A sign-in page reached from an email can be a copy of the real one. Rather than entering a password there, open the website yourself by typing its address or using a saved bookmark.
- Unexpected attachments. Invoices, shipping documents, voicemail files and “secure messages” are favorite disguises for harmful files. Be especially careful with compressed archives or files that ask you to enable macros or editing.
Clue four: the message itself
- Generic greeting. “Dear customer” or “Dear user” from an organization that normally uses your name. Note that some real mass messages also use generic greetings, and some phishing uses your name because details were obtained from earlier data breaches.
- Unusual wording or formatting. Odd phrasing, mismatched logos or awkward layout can be signs. But polished writing is not proof of honesty, since tools that generate AI-generated content make professional-sounding text easy to produce.
- Requests that do not fit. Real organizations generally do not ask you to send a password, read out a code or confirm full card details by email.
What to do when you suspect phishing
- Do not click, open attachments or reply. Replying confirms your address is active.
- Verify separately. If the message mentions an account or a colleague, contact the real organization or person using details you already have, not those in the message.
- Report it. Many email services have a report phishing or junk option. Workplaces often have an IT or security team that wants to see suspicious messages. Forwarding it to them, if they ask for that, helps protect coworkers.
- Delete it after reporting.
If you clicked or entered details
It happens to careful people. Move calmly and quickly.
- If you entered a password, change it right away on the real website, and on any other site where you used the same one. Password reuse is why one slip can spread, and two-step verification can add a second barrier.
- If you shared card or bank details, contact your bank or card issuer and explain.
- If you opened an attachment or installed something, disconnect the device from the internet, run a security scan with software you trust and, if it is a work device, tell your IT team immediately.
- Watch your accounts and statements in the following weeks for anything you do not recognize.
Building steady habits
Keeping software updates turned on and using one of the many password managers, which typically fill in credentials only on matching websites, both reduce risk. None of these habits is perfect, but together they make a single mistake less costly.
This is general information, not technical or legal advice. For a specific situation, your bank, your workplace IT team or your local authorities are the right places to ask.