You get an email that looks like it is from your bank. It says your account has a problem and you must log in right now to fix it. The logo looks right, the message sounds official, and your heart skips a beat. You are about to click…
Stop. This could be phishing, one of the most common online scams in the world. In this guide, you will learn what phishing is, how it works, the 7 red flags to look for, and exactly what to do if you have already clicked.
What Is Phishing?
Phishing is an online scam where an attacker pretends to be someone you trust, such as a bank, a delivery company, your employer, or even a friend, to trick you into giving away sensitive information or clicking a harmful link. That information can include passwords, card numbers, and one-time codes (OTPs).
The name is a play on the word “fishing”. Attackers cast out bait, such as a fake message, and wait for someone to bite.
Phishing targets people, not technology. Even strong security cannot help if someone is tricked into handing over the keys.
How Does Phishing Work?
Most phishing attacks follow the same pattern:
- The bait: the attacker sends a message that looks like it comes from a trusted source.
- The pressure: the message creates urgency, fear, or curiosity so you act without thinking.
- The action: you click a link, open an attachment, or reply with information.
- The trap: a fake login page captures what you type, or malware is installed on your device.
- The theft: the attacker uses your details to access your accounts or money.
Common Types of Phishing
| Type | How it works |
|---|---|
| Email phishing | Mass emails pretending to be well-known brands or services. |
| Spear phishing | A targeted message that uses details about you, such as your name, job, or recent activity. |
| Smishing | Phishing by SMS or messaging apps, for example fake delivery or bank alerts. |
| Vishing | Phishing by phone call, often someone claiming to be from your bank or tech support. |
| Quishing | Fake QR codes that lead to malicious websites. |
| Business email compromise | A fake message that looks like it comes from your boss or a supplier, asking for urgent payment or details. |
| Social media phishing | Fake direct messages, giveaways, or “Is this you in this video?” links. |
7 Red Flags of a Phishing Email
No single sign proves a message is a scam, but the more of these you spot, the more careful you should be.
Red Flag 1: Urgency or threats
Messages like “Your account will be closed in 24 hours” or “Act now or lose access” are designed to make you panic. Real companies rarely demand instant action through a link. Pressure is the scammer’s best tool.
Red Flag 2: The sender’s address does not match
The display name may say “YourBank Support”, but the actual address could be something like support@yourbank-secure-login.example. Always check the full email address, not just the name. Look for extra words, hyphens, or small spelling changes in the domain.
Red Flag 3: A generic greeting
“Dear customer” or “Dear user” is a warning sign when the message claims to be from a company that normally uses your name. (Spear-phishing messages may include your name, so do not rely on this flag alone.)
Red Flag 4: Suspicious links
Hover over a link (or press and hold on a phone) to preview where it really goes before you tap. Be careful with shortened links, links that do not match the company’s real website, and addresses with odd extra words.
Red Flag 5: Unexpected attachments
Invoices, “scanned documents”, delivery notes, or ZIP files you were not expecting can contain malware. If you did not expect it, do not open it. Confirm with the sender using a different method.
Red Flag 6: Requests for passwords, PINs, or OTP codes
A real bank or service will never ask you to send your password, PIN, or one-time code by email, text, or phone. Anyone who asks for an OTP is trying to log in as you.
Red Flag 7: Too good to be true, or an unusual request
Surprise prizes, easy refunds, urgent gift-card requests from your “boss”, or a friend asking for money out of nowhere are classic tricks. If it feels strange, verify it before acting.
Older phishing emails were full of typos, but modern scams can look polished and professional, including messages written with AI tools. Judge the sender, the link, and the request, not just the grammar.
The 5-Step Check Before You Click
Whenever a message asks you to do something, run this quick check:
- Stop and breathe: Do not click or reply right away. Scammers rely on you acting fast.
- Check the sender: Look at the full email address or phone number, not only the display name.
- Hover over the link: Preview the real destination. If it looks wrong, do not tap it.
- Verify another way: Open the official app or type the website address yourself. Or call the number on the back of your card or on the official website.
- Report and delete: Use your email app’s “Report phishing” option, then delete the message.
If a message asks you to log in, pay, or verify something, do not use the link in the message. Go to the official app or website yourself.
Real vs Fake: A Side-by-Side Example
Here is an example of a phishing text. The company name and website are made up for illustration.
| What to check | Real message | Phishing message |
|---|---|---|
| Sender | support@yourbank.com | support@yourbank-secure-login.example |
| Greeting | Uses your name | “Dear customer” |
| Link | The company’s real website | A strange, long, or shortened address |
| Tone | Calm and informative | Urgent, threatening, or too good to be true |
| Request | Asks you to open the official app yourself | Asks you to “verify” details through a link |
What to Do If You Clicked a Phishing Link
Do not panic. Acting quickly limits the damage. Follow these steps:
- Stop and do not enter anything. If the page asked for details and you have not typed them, close it.
- If you entered a password, change it right away from the real website or app. Also change it anywhere else you used it. Our strong password creation guide shows how.
- Turn on two-factor authentication (2FA) on that account.
- If you shared card or bank details, contact your bank or provider immediately.
- If you opened an attachment or installed something, disconnect from the internet and run a full scan with trusted security software.
- Check your account activity, sent messages, and email forwarding rules for anything you do not recognise.
- Report it to your email provider, the company being impersonated, and your local cybercrime authority.
- Stay alert for follow-up scams. Attackers often try again.
How to Protect Yourself From Phishing
- Use a unique, strong password for every account so one stolen password cannot unlock everything.
- Use a password manager. It will not autofill your login on a fake website, which is a helpful warning sign.
- Turn on two-factor authentication (2FA), preferably with an authenticator app.
- Keep your phone, computer, and apps updated.
- Use your email’s spam and phishing filters and report suspicious messages.
- Never share OTP codes, PINs, or passwords with anyone, even someone who sounds official.
- Slow down. Pause for ten minutes before acting on anything urgent.
- Teach family and colleagues what to look for, especially parents and grandparents.
Quick Phishing Safety Checklist
- ☐ I check the full sender address before trusting a message
- ☐ I hover over links before I tap them
- ☐ I never share OTP codes, PINs, or passwords
- ☐ I open the official app or website myself instead of using message links
- ☐ I use a different password for every account
- ☐ Two-factor authentication is on for my email and banking
- ☐ I know what to do if I click a bad link
Be ready before something goes wrong
Get our 9-page Phishing Safety Action Checklist: a 60-second inspection check, 6 real-style scam examples, an “I clicked” emergency guide, and a quiz with answers.
Get the Phishing Checklist →Frequently Asked Questions
What is phishing in simple words?
Phishing is a scam where someone pretends to be a trusted person or company, such as your bank or a delivery service, to trick you into sharing private information or clicking a harmful link.
How can I tell if an email is phishing?
Look for urgency, a sender address that does not match the company, generic greetings, suspicious links, unexpected attachments, and requests for passwords or one-time codes. When unsure, contact the company through its official app or website.
What is the difference between phishing and spam?
Spam is unwanted bulk messaging, usually advertising. Phishing is deceptive and aims to steal your information or money or to infect your device. Some spam messages are also phishing.
What should I do if I clicked a phishing link?
Do not enter any details. If you already did, change that password right away from the real website, change it anywhere else you reused it, turn on two-factor authentication, check your account activity, and contact your bank if payment details were involved.
Can phishing happen through text messages, calls, and QR codes?
Yes. Phishing by text is called smishing, by phone call is vishing, and fake QR codes are sometimes called quishing. The same rule applies: do not trust unexpected requests, and verify through official channels.
Is phishing illegal?
Yes. Phishing is a form of fraud in most countries. If you lose money or data, report it to your bank or provider and to your local cybercrime authority.
Can opening a phishing email alone harm me?
Most phishing needs you to click, download, or reply. However, some malicious attachments or links can install malware, so avoid opening unexpected attachments and links, and keep your devices updated.
Final Thoughts
Phishing is successful because it plays on trust and urgency. The good news is that a few simple habits stop most attacks: pause, check the sender, hover over links, verify through official channels, and never share codes or passwords.
Your next step: turn on two-factor authentication for your email today, and share this guide with one family member who might be an easy target for scammers.
This article is for general education and does not replace advice from a qualified security professional. Company names and websites in examples are fictional.