Phishing is a social-engineering scam designed to make you reveal information, open a harmful file, send money, or visit a fraudulent website. The message may arrive by email or text, appear in a social-media message, or show up as a fake login page. Some scams imitate banks, delivery companies, employers, schools, government agencies, or people you know.
The most reliable approach is not to look for one “magic” warning sign. Instead, pause and evaluate the message’s identity, request, timing, link, and consequences. A message can look polished and still be fraudulent, while a legitimate message can be poorly written or sent from an unfamiliar address.
The fastest phishing check: stop, inspect, and verify
- Stop. Do not click, reply, call a number in the message, open an attachment, or scan a QR code while you are deciding whether the message is real.
- Inspect. Look at the sender, the exact web address, what the message asks you to do, and whether the situation makes sense.
- Verify independently. Open the organization’s known app or type its website address yourself. Contact a person or company using information you already trust—not the contact details supplied in the suspicious message.
Urgency is often the mechanism that prevents this process. If a message says your account will be closed, a payment is overdue, or someone needs an immediate favor, treat the pressure as a reason to slow down rather than a reason to act quickly.
Warning signs in phishing emails
1. The sender is not who the display name suggests
Email programs commonly show a friendly display name, such as “Your Bank” or “Payroll,” while hiding the actual address. Expand the sender details and examine the full address. Be cautious when the domain is misspelled, uses an unexpected ending, contains extra words, or belongs to a consumer email service when you expected a business account.
Do not assume a familiar address proves the message is safe. An account can be compromised, or the visible sender information can be manipulated. The sender is one clue, not a final verdict.
2. The message creates pressure or fear
Common pressure tactics include claims that you must act immediately, confirm your identity, prevent an account suspension, release a package, or avoid legal trouble. A legitimate organization may contact you about a real issue, but you should still verify the request through a separate channel before signing in or paying.
3. It asks for sensitive information or an unusual payment
Be especially cautious when a message requests a password, multifactor authentication code, Social Security number, bank details, gift cards, cryptocurrency, wire transfers, or a change to payment instructions. Unexpected requests to keep a transaction secret are another strong warning sign.
4. The link does not lead where you expect
On a computer, place your pointer over a link without clicking to preview its destination. On a phone, press and hold only if your device safely displays the destination without opening it. Look for the actual domain name, not merely a familiar word somewhere in a long address.
For example, an address that ends in example.com is different from one that ends in example-login.com, example.com.some-other-site.net, or a misspelled version of the company’s domain. HTTPS and a padlock indicate an encrypted connection; they do not prove that the site itself is legitimate.
5. The context is wrong
Ask whether you were expecting the message. Did you recently place an order, contact the company, apply for a job, or request a password reset? Unexpected invoices, delivery notices, shared-document alerts, and account warnings deserve extra scrutiny. A scammer may use a plausible subject line without knowing anything specific about your activity.
6. The writing or formatting feels unusual
Spelling mistakes, odd grammar, mismatched logos, unusual greetings, and awkward formatting can be clues. They are not conclusive: scammers can produce polished messages, and legitimate organizations sometimes send imperfect communications. Focus more heavily on the request, link, and verification options.
How to spot phishing texts and messaging-app scams
Text-message scams often rely on a short message and a link that is difficult to inspect on a small screen. Common themes include package delivery problems, unpaid tolls, bank alerts, account verification, job offers, and messages that appear to come from a friend asking for help.
- Be skeptical of unexpected messages containing links, especially shortened links.
- Do not reply with personal information or a one-time security code.
- Do not call a phone number supplied by an unverified text.
- Check with the supposed sender using an existing contact or a known app.
- If the message claims to be from a business, open that business’s app or type its address manually instead.
A message from a known contact can still be fraudulent if that person’s account was taken over. If the request is unusual—particularly a request for money, codes, or secrecy—verify it by calling the person using a number already saved in your contacts.
How to tell whether a website is fake
A phishing website may copy the colors, logo, sign-in form, and wording of a real service. Before entering a password or payment detail, check the following:
- Domain: Identify the registered domain name near the end of the address. Subdomains and added words can make a fraudulent address look familiar.
- Address: Watch for misspellings, extra characters, unusual domain endings, and addresses that use a company name only as part of a longer domain.
- Unexpected redirects: A link that sends you through several unrelated domains or opens a login page you did not expect deserves caution.
- Request: Question why the site needs a password, security code, payment, or identity document at this particular moment.
- Browser warnings: Never bypass a browser’s warning about an unsafe connection or suspected deceptive site.
Do not treat a professional design, a padlock, or the presence of a privacy policy as proof of authenticity. When in doubt, close the page and start from a known bookmark, the official app, or an address you enter yourself.
QR codes, attachments, and fake phone numbers
Phishing does not require a conventional clickable link. A QR code can send you to a fraudulent login or payment page, particularly when it appears in an unexpected email, package notice, poster, or invoice. Inspect the destination before opening it and verify the request through a trusted route.
Unexpected attachments can contain malicious software or lead to a fake sign-in page. Be cautious with invoices, shipping documents, shared files, and voicemail transcriptions that you did not expect. File names and familiar-looking icons are not proof of safety.
Some scams tell you to call a “support” number. The person who answers may claim your computer or account is compromised and ask for remote access, payment, or a verification code. Use a phone number from a genuine statement, official app, or independently located company website instead.
A practical decision framework
Use these questions before taking action:
- Who is contacting me? Check the full sender address, phone number, account, or website domain.
- What do they want? Identify whether the request involves a login, code, money, personal information, attachment, or remote access.
- Why now? Decide whether the message connects to something you actually initiated.
- What happens if I wait? Real problems can usually be verified through an official channel. A demand that you act immediately is not a reason to skip verification.
- Can I verify it elsewhere? Use a known app, saved contact, physical statement, or manually entered website address.
If you cannot verify the message independently, do not act on it. You can delete it, report it as spam or phishing through your email or messaging app, and contact the organization separately if the subject may be genuine.
What to do if you clicked or shared information
A click does not always mean your device is compromised, but take the event seriously. The appropriate response depends on what happened:
- Clicked but entered nothing: Close the page. Do not download files or approve unexpected prompts. Run your device’s normal security checks and watch for unusual account activity.
- Entered a password: Change it immediately through the real service, not through the suspicious link. Change it anywhere else that reused the same password. Review active sessions and sign out unfamiliar devices if the service offers that option.
- Shared a multifactor code: Contact the real service promptly, change the password, review recovery settings, and check for unauthorized changes to authentication methods.
- Shared financial or identity information: Contact the relevant bank, card issuer, or identity-related service using a trusted number. Ask what protective steps are appropriate, such as replacing an account credential or monitoring transactions.
- Sent money: Contact the payment provider or financial institution immediately. Some transfers may be difficult to reverse, so speed matters.
- Installed software or granted remote access: Disconnect the device from the internet if necessary, remove unauthorized software, and seek qualified technical help. Change important passwords from a separate, trusted device.
Keep a record of what happened, including the message, time, website, information shared, and actions taken. Do not continue communicating with the scammer to “fix” the problem.
A short checklist to remember
- Unexpected contact plus urgency is a reason to pause.
- Inspect the full sender address and website domain.
- Never disclose passwords or one-time codes in response to an unsolicited message.
- Verify requests using an app, website, or phone number you found independently.
- Do not bypass browser warnings or open unexpected attachments.
- If you made a mistake, act quickly: secure accounts, contact financial providers, and document the incident.
Phishing detection is less about perfectly identifying every fake message than about refusing to let an unexpected message control your next action. When a request involves access, money, or sensitive information, independent verification is the safest default.