How to spot phishing messages before you click

Phishing is a message designed to look as if it comes from a bank, a delivery company, an employer or a service you already use, with the goal of getting you to click a link, open an attachment or type in your login details. These messages arrive by email, text, direct message and phone call, and many are polished, with real logos and convincing wording. You rarely need one decisive flaw to spot them. Usually several small signals point the same way, and the message only has to feel urgent enough to make you act before checking.

The practical approach is to check the message against what you already know, rather than against what the message tells you. Treat any request to sign in, pay or confirm details as something you verify through a route you choose yourself, such as going to the official website directly or calling a number from a statement you already have.

Watch for pressure and unusual requests

Phishing often creates a sense of urgency. Common lines say that an account will close within a day, a payment failed and must be confirmed right away, a parcel needs immediate action, or unusual activity has been detected. The goal is to make you act before you think. A genuine notice can also be time-sensitive, but it rarely requires you to enter a password through a link in an unexpected email, or to buy gift cards or send money.

Pay attention to requests that do not fit how the organization normally works. A bank does not usually need you to read a one-time code aloud over the phone, and a support team does not normally ask for your full password. Requests to send a photo of an identity document, or to change payment details through a new link, are also warning signs. Offers of refunds or prizes you never requested belong in the same category. An unusual request combined with high pressure is the clearest signal to stop.

Check the sender and the link destination

A sender's display name can be set to anything, so a message that claims to be from a known company may not be. Look at the actual email address and check whether its domain matches the organization. Small differences are easy to miss: an extra word, a substituted letter, a hyphen or an unfamiliar ending. What matters is the registered domain, the part just before the top-level ending. A name like account-security followed by an unrelated domain belongs to a different organization, even when the first part sounds right.

Links need the same care. On a computer, hover over a link to see its real destination in the status area at the bottom of the window before you click. On many phones, pressing and holding a link previews the address. Shortened links hide the destination entirely, so treat them with caution in unexpected messages. QR codes are another route to fake sites because you cannot read the destination before scanning. Scan only codes from sources you trust, and check the address that appears before you sign in anywhere.

Be careful with attachments and sign-in pages

Unexpected attachments are a common way to deliver malicious software. Be especially cautious with files that ask you to enable macros or content, with compressed archives you did not expect and with anything that claims to be an invoice or shipping document you never requested. If the sender is someone you know, contact them through a separate channel before opening the file.

Phishing pages often copy the sign-in screen of a real service. Before typing a password, check the address bar for the exact domain. A secure connection indicator is not proof that a site is genuine, since fake sites can use encryption too. A password manager that offers no autofill on a login page can be a helpful signal, because it usually means the address differs from the one you saved.

What to do with a suspicious message

If a message looks suspicious, do not click anything in it, and do not reply. Go to the company's official website or open its app directly and check whether the notice appears there. If you still cannot tell, contact the company using a phone number or address from its official site or from a statement you already have, not from the message itself.

Report the message using your email app's report phishing option where one is available, then delete it. If you clicked a link or entered information, act quickly. Change the password for the affected account and for any other service where you used the same password, turn on two-factor sign-in if it is not already active and review recent account activity for changes you did not make. If you shared banking or card details, contact your bank or card issuer right away. If you sent money or gift cards, contact the payment provider as soon as possible, because reporting early gives you the best chance to limit losses.

Phishing also arrives by text message and phone call, where there is even less visible detail to check. Treat an unexpected call or text that asks for codes, passwords or payment the same way: pause, verify through a route you chose and only then respond.