What phishing is
Phishing is an attempt to trick you into giving away something valuable, usually by pretending to be a trusted sender. The target might be a password, a card number, a one-time code, or simply your willingness to click a link or open an attachment that installs harmful software. When the message arrives as a text, it is often called smishing, and when it comes by phone, vishing. The basic idea is the same in all of them.
Phishing works because it exploits ordinary behavior: people are busy, they trust familiar names, and they react to alarm. A well-made message looks like the real thing, which is why checking habits matter more than a sharp eye alone.
Common warning signs
No single sign is proof, and good fakes may show none of them. Several together are a strong signal.
Urgency or threats. Your account will be closed, a payment failed, a package will be returned, or something must be done within hours.
An unexpected request. A message about an order you did not place, a bill from a company you do not use, or a prize you never entered.
Requests for sensitive information. Genuine organizations rarely ask you to send passwords, full card numbers or codes by email or text.
A sender address that is slightly wrong. The display name may look right while the actual address belongs to an unrelated domain. Look closely at the part after the @ symbol. Small spelling changes, extra words or odd endings are common tricks.
Generic greetings. “Dear customer” instead of your name, although some phishing messages do use your name, because personal details can come from earlier leaks.
Links that do not match. On a computer, hovering over a link reveals where it really goes. On a phone, pressing and holding a link often shows the address. Shortened links hide the destination.
Unusual attachments. Unexpected invoices, voicemail files or documents that ask you to “enable content”.
Awkward wording. Poor grammar can be a clue, but it is no longer reliable, since tools can now write fluent text. This includes messages produced with generative ai, so tidy writing does not prove a message is genuine.
Odd channel. A bank or delivery company suddenly contacting you on a messaging app, or a “boss” asking from a personal account for gift cards.
Examples of typical stories
These are generic patterns, not specific messages.
- A text says a parcel could not be delivered and asks you to pay a small fee through a link.
- An email claims suspicious sign-in activity and asks you to confirm your password.
- A message appears to come from a colleague or manager and asks for an urgent favor.
- A notice says a subscription has renewed for a large amount and gives a number to call to dispute it.
- A “wrong number” text starts a friendly chat that slowly leads to money.
Such stories overlap with the patterns families see in online scams.
What to check before you act
- Pause. Take a breath. Urgency is the tool; slowing down removes it.
- Do not use the links or numbers in the message. Open the company’s official app or type its address yourself, or use the number on a card or past bill.
- Check the sender. Look at the full address, not just the display name.
- Ask yourself whether you expected it. If not, treat it as unverified.
- Check with the person. For a message from a friend, relative or colleague that seems odd, ask them through another channel, such as a phone call.
- Look at the destination. If you do open a link, inspect the address and expect a padlock only as a minimum, since scam sites can have one too.
What to do if you suspect phishing
- Do not reply, even to say “stop”, and do not click or open attachments.
- Report the message using your email or messaging app’s reporting option, then delete it.
- Forward it to the organization being impersonated if it publishes an address for that, or to your country’s fraud reporting service.
- Tell family, since the same sender often targets several people.
If you already clicked or replied
Act quickly but calmly.
- If you entered a password, change it on the real site at once, and anywhere else you used it. A password manager makes the replacement easier, and two-factor authentication adds protection if the old password is used.
- If you shared card or bank details, contact the bank or card provider through an official number and follow its guidance.
- If you opened an attachment or installed something, disconnect from the network, run a security scan with your device’s protection tools and consider getting help from a trusted professional.
- If you gave away a code, treat the account as compromised and secure it as above.
- Keep a record of what happened, with times and screenshots, in case you need to report it.
Nobody should feel embarrassed. Professional and careful people are caught out regularly, and people who report quickly usually limit the damage.
Reducing your exposure
Keep devices and apps up to date, since software updates close holes that malicious links try to use. Use the spam filter your email provider supplies. Limit the personal details you share publicly, since scammers use them to make messages convincing; the guidance on social media privacy helps here. After news of data breaches, expect more targeted phishing, because the leaked details are useful to criminals.
Phishing is a common reason accounts get taken over, but you do not need to be an expert to resist it. The consistent habit of not acting on unexpected messages, and verifying through a route you chose yourself, handles most cases. For the wider context, see the family guide to online safety. This article is general information and no habit is a guarantee.