Phishing

Phishing is a form of fraud in which someone impersonates a trusted person, organisation or service to trick you into revealing information, sending money, opening a harmful attachment or visiting a deceptive website.

Unlike a technical hack that breaks through software, phishing targets people. It works by exploiting trust and emotion rather than a weakness in a computer system, which is why it remains one of the most common and effective ways accounts are compromised.

Phishing takes many forms. Email phishing is the classic version: a message that looks like it comes from your bank, a delivery service, a colleague or a familiar company, asking you to click a link or open an attachment. Text-message phishing uses the same tactics over SMS — a parcel 'delivery problem', a bank 'alert', a payment 'confirmation'. Fake login pages reproduce a familiar sign-in screen closely enough to fool a quick glance, then capture whatever you type. Impersonation can even happen over the phone, with someone claiming to be from IT support, your bank or a government office.

A few warning signs recur. A sense of urgency or pressure — act now, or else — is one of the most reliable signals, because fraudsters use it to stop you thinking clearly. Unexpected requests for passwords, codes or payments are another. Suspicious links that don't quite match the organisation they claim to be from, or that lead to an unfamiliar address, deserve a second look. And requests that arrive out of the blue and ask you to do something unusual almost always warrant checking independently.

'Checking independently' is the practical heart of resisting phishing: if a message claims to be from your bank, don't use the link or number it provides — go to the bank's site or app yourself, or call the number you already know. A legitimate organisation will never mind you verifying; a fraudster depends on you not bothering.

A few habits make a large difference. Using a passkey instead of a password removes the thing phishing most often tries to steal, because passkeys are cryptographically bound to the real site and will not work on a fake one. Two-factor authentication means a phished password alone is not enough to get in. A password manager helps too, because it will not offer to fill credentials on a lookalike domain. And cloud storage accounts, which often hold irreplaceable files, deserve the same protections as anything else.

If you think you may have responded to a phishing attempt, don't panic — act. Change the password for the affected account from a known-safe device, turn on 2FA if it wasn't already, check for any unrecognised activity, and if money is involved, contact your bank through their official channels. Reporting the message helps protect others too.