How to Identify and Avoid Online Phishing Scams

What phishing is

Phishing is an attempt to trick you into handing over something valuable, such as a password, a card number, a one-time code or access to your device. The message pretends to come from someone you trust: a bank, a workplace, a delivery service, a popular website or even a friend. It usually asks you to click a link, open a file or reply with information.

The messages vary in quality. Some are full of obvious errors, but others are polished and copy real branding closely. Judging a message by how professional it looks is not reliable. It is safer to look at what it asks you to do.

Warning signs in the message

No single sign proves a message is fake, and some real messages have odd features. Several signs together should make you stop.

• An unexpected request. You did not start anything, yet you are told to verify, confirm, update or claim something.
• Urgency or threats. Warnings about closed accounts, unpaid bills or legal trouble are meant to rush you.
• A generic greeting. “Dear customer” from an organization that normally knows your name can be a clue, although better-made messages use your name.
• A mismatched sender. The display name looks right, but the actual address behind it belongs to a different domain or is slightly misspelled.
• A link that does not match. On a computer, hovering over a link usually shows its real destination. On a phone, pressing and holding often does the same. If the destination looks unrelated, do not follow it.
• Unusual attachments. An unexpected invoice, voicemail or “document” you did not ask for is risky to open.
• Requests for sensitive details. Legitimate organizations generally do not ask for your full password or a one-time code by message.
• Odd wording or tone. A message that sounds slightly off for the supposed sender deserves a second look.

Spotting fake login pages

A phishing link often leads to a page that imitates a real sign-in screen. Once you type your details, they go to the scammer instead.

Look at the web address before entering anything. Check the whole domain, especially the part right before the first single slash. Lookalike web addresses may swap letters, add extra words or use a different ending. A padlock symbol only means the connection is encrypted; scammers can have one too, so the browser padlock meaning is limited and should not reassure you on its own.

A safer habit is not to sign in through message links at all. Instead, open the official app or type the site’s address yourself, or use a bookmark you saved earlier. A password manager can help here, since it generally fills in saved logins only on the site they were saved for, and a missing prompt can be a hint that something is off.

Phishing outside email

Phishing is not limited to email. It also arrives as text messages, direct messages on social media, calls, messaging-app notes and even QR codes in public places. The text message scams guide and the notes on QR code safety cover those channels. The same test applies everywhere: did I expect this, and can I confirm it another way?

How to check a suspicious message safely

1. Do not click, reply or open attachments yet.
2. Contact the supposed sender through a channel you already trust, such as the official app, the number on your card or the website you typed yourself.
3. Ask a coworker or family member if you are unsure. In a workplace, follow your organization’s process for reporting suspicious messages.
4. Use the report button in your email or messaging app if one exists. This helps filters learn, and spam email filtering improves over time as people report problems.
5. Delete the message once it is reported.

If you already clicked

Clicking a link alone does not always cause harm, but it is sensible to act carefully.

• If you only opened the page: close it and do not enter anything. Running your device’s built-in security checks is reasonable.
• If you typed a password: change that password immediately on the real site, from a device you trust. If you reused it elsewhere, change it on those accounts too. Turn on two-step sign-in where available.
• If you entered card or bank details: contact your card issuer or bank promptly, using the number on your card or in their official app, and ask about next steps.
• If you entered a one-time code: treat the account as compromised and begin your hacked account response steps, including checking recovery settings and signed-in devices.
• If you opened an attachment or installed something: disconnect the device from the internet if you can, run a security scan, and consider asking a trusted technician for help.
• If the message came from a workplace address or you used a work login: tell your IT or security contact straight away. Reporting quickly matters more than avoiding embarrassment.

Keep screenshots and details of what happened, and report the message to the impersonated organization and to your national fraud-reporting service. If you lost money or fear for your safety, contact your local police.

Habits that make phishing less effective

Slow down when a message creates strong emotion. Keep software and browsers updated. Use unique passwords so one stolen login does not unlock everything. Turn on account notifications so you hear quickly about sign-ins you did not make. Most importantly, treat any message that pushes you to act immediately as a reason to verify first.

Phishing tactics change, and no habit gives complete protection, but careful checking removes much of the risk. This is general information, not professional security advice.