This guide is for anyone who handles email at work or manages household accounts, and especially for the person others ask, “Is this real?” That might be the office manager at a small firm, the adult child who handles a parent’s online banking, or the freelancer whose inbox is full of invoices from clients. Phishing messages are designed to look ordinary, and they no longer give themselves away with obvious spelling mistakes. A few habits catch most of them.
What phishing is
Phishing is a message, usually email or text but sometimes a phone call or social media message, that tries to trick you into clicking a link, opening an attachment, sending money or giving away information such as passwords and bank details. Text-message phishing is often called smishing, and voice phishing vishing.
The goal is usually one of three things: steal login details, install malware, or get you to pay money to the wrong place.
The warning signs CISA highlights
The US Cybersecurity and Infrastructure Security Agency lists common signs of phishing in its guide to recognising and reporting phishing. They include:
- Urgent or emotionally appealing language, especially messages claiming dire consequences if you do not respond immediately
- Requests to send personal and financial information
- Untrusted shortened URLs
- Incorrect email addresses or links, such as a lookalike spelling of a well-known shopping site
CISA also makes an important point about an old rule of thumb. Phishing has often contained poor grammar or misspellings, but in the era of artificial intelligence some phishing emails now have perfect grammar and spelling. Do not rely on clumsy writing to warn you; look for the other signs.
The most common disguises
| Disguise | What it says | What it wants |
|---|---|---|
| Delivery company | “We couldn’t deliver your parcel. Pay a small fee to rebook.” | Card details |
| Bank or card issuer | “Unusual activity. Verify your account now.” | Online banking login |
| Email provider or IT team | “Your mailbox is full” or “Password expires today” | Email password |
| Boss or senior colleague | “Are you at your desk? I need a quick favour.” | Gift cards or a payment |
| Supplier | “Our bank details have changed; please update before paying.” | Redirected invoice payments |
| Tax or government agency | “You are owed a refund” or “You face a penalty” | Identity details or a payment |
| Subscription service | “Your payment failed; update your billing.” | Card details |
The supplier version, often called business email compromise, is especially costly for small businesses because the amounts are real invoice totals.
Phishing works by creating hurry. The best defence is to slow down for ten seconds.
The ten-second check
Before clicking a link or opening an attachment in any message that asks you to act, run through these questions.
Was I expecting this?
An invoice from a supplier you have never heard of, a parcel you did not order, a password reset you did not request: unexpected messages deserve suspicion.
Who really sent it?
Look at the actual email address, not just the display name. On a phone, tap the sender’s name to reveal the address. Watch for small changes, such as an extra letter, a different ending, or a free email service used by a supposed company.
Where does the link go?
On a computer, hover over the link without clicking and read the address that appears. On a phone, press and hold the link to preview it. The part that matters is the domain just before the first single slash. A link reading something like yourbank.secure-login.example.com belongs to example.com, not your bank.
Is it pushing me to hurry or keep quiet?
Deadlines measured in hours, threats of account closure, and requests to keep something confidential are classic pressure tactics.
Is it asking for something unusual?
Your bank will not ask for your full password by email. Your boss is unlikely to need gift cards urgently. A supplier rarely changes bank details by email alone.
Verify through a separate channel
When a message seems plausible but you are not sure, check it by a route the scammer does not control.
Use your own bookmark or app
Instead of clicking the link, open the company’s app or type its address yourself and log in. If there is really a problem with your account, you will see it there.
Call a known number
For payment requests and bank detail changes, phone the person or company using a number you already have, such as the one on a previous invoice, the back of your card or the official website. Never use a number given in the suspicious message.
Ask a colleague
In a workplace, a quick “did you send this?” message to the supposed sender, through a different app, stops many scams.
Texts, calls and QR codes
Email is not the only route. The same tricks now arrive in other forms.
Text messages
Smishing texts are short and urgent: a toll you supposedly did not pay, a parcel waiting, a bank alert. Links in texts are hard to inspect on a small screen, so treat any text asking you to tap a link and pay or log in as suspect. Go to the company’s app or website directly instead.
Phone calls
Callers may pose as your bank’s fraud team and ask you to “confirm” a code that was just texted to you. That code is often the second factor protecting your account. No genuine bank fraud team will ask you to read it out. Hang up and call the number on your card.
QR codes
Scammers sometimes stick fake QR codes on parking meters or send them in emails, leading to lookalike payment pages. Check the web address that opens before entering any details, and pay through the official app where you can.
Protect yourself in advance
Turn on two-factor authentication
If a phishing email does capture your password, a second factor can still stop the attacker getting in. Passkeys and hardware security keys go further, because they will only work on the genuine website.
Use a password manager
Managers typically autofill only on the real site. If your password manager does not offer to fill a login page, check the address carefully.
Keep software updated
Updates close security holes that malicious attachments and links try to exploit. Turn on automatic updates for your operating system, browser and apps.
Set a payment rule at work
For small businesses, a simple policy prevents most invoice fraud: any change to a supplier’s bank details must be confirmed by phone with a known contact before a payment is made, and any unusual payment request needs a second person’s approval.
Report it
CISA encourages people to report phishing instead of simply deleting it, to protect themselves and others. Its guidance notes that most email services and social platforms offer a “report phishing” or “report spam” option, typically near the sender’s address or in the toolbar or settings. At work, forward suspicious messages to your IT contact or follow your organisation’s reporting process. You can also report scams to the Federal Trade Commission at ReportFraud.ftc.gov.
If you have already clicked
Act quickly. Speed limits the damage.
- If you entered a password, change it immediately on the genuine site, and on any other site where you used the same password. Turn on two-factor authentication if it was off.
- If you entered card or bank details, call your bank using the number on your card and ask it to block the card and watch for fraud.
- If you opened an attachment or installed something, disconnect the device from the internet and run a security scan. At work, tell IT straight away, even if nothing seems wrong.
- If you sent money, contact your bank immediately. The sooner a fraudulent transfer is reported, the better the chance of recovering it.
- Watch your accounts and credit reports for unfamiliar activity over the following weeks.
Nobody should feel embarrassed. Phishing is designed by professionals to fool careful people, and reporting quickly is what matters.
Phishing checklist
- Expected? If not, slow down
- Real sender address checked, not just the name
- Link previewed; domain matches the real company
- No pressure to hurry or keep it secret
- Request makes sense for the sender
- Verified through your own app, bookmark or known phone number
- Two-factor authentication on key accounts
- Password manager in use
- Supplier bank-detail changes confirmed by phone
- Suspicious messages reported, not just deleted
Takeaway
Phishing relies on urgency and imitation, and CISA warns that perfect grammar is no longer a sign of safety. Check who really sent a message, preview every link, verify through a channel you trust, and report what you find. If you do click, change passwords and call your bank straight away.
