How to Spot a Phishing Email or Text Message

Phishing is the single most common way ordinary people lose access to accounts or money. The good news is that you don't need to spot every fake message — you just need to recognise a small set of patterns and build a couple of habits that make the common tricks not work.

This is a calm, practical guide. The aim is not to make you anxious; it's to make you harder to fool.

Urgency

Phishing almost always creates pressure. "Your account will be closed in 24 hours." "Payment failed — act now." "You have an unpaid toll." Urgency is designed to make you act before you think. The single most useful habit is to treat urgency as a signal to slow down, not speed up. Legitimate organisations rarely require an instant response under threat.

Impersonation

The sender will claim to be someone you trust: your bank, a delivery service, a government body, a colleague, a familiar brand. Look past the logo and the friendly tone. The question is always the same: is this actually from them? Names and display text are trivial to fake; the underlying address is harder to hide, though it can be spoofed too. When in doubt, don't reply — verify another way.

Unexpected requests

Be cautious of anything you weren't expecting: a package you didn't order, an invoice you don't recognise, a security alert for a login you made, a message from a friend that feels slightly off. "Unexpected" plus "asks you to do something" is a combination worth questioning.

Suspicious links

Before clicking, hover over a link (or long-press on mobile) to preview where it actually goes. Watch for:

• Slightly altered names: paypa1.com, rnicrosoft.com, amaz0n.
• Long, random-looking addresses.
• Domains that imitate a brand but aren't it.

If you're not sure, don't click. Go to the service directly instead.

Fake login pages

A common goal of phishing is to capture your username and password on a lookalike login page. The page may look identical to the real one. The defence is simple and reliable: never reach a login page by clicking a link in an unexpected message. Type the address yourself, or use a bookmark or the service's app. If you do that, fake pages stop being a threat.

Attachments

Unexpected attachments — especially invoices, receipts or "documents" from people you don't know — can carry malware. Don't open attachments you weren't expecting, and be cautious even when the sender seems familiar. If a colleague sends something odd, check with them through another channel first.

Payment requests

Be especially careful with anything involving money: a request to pay an "overdue" bill, confirm card details, move funds, or buy gift vouchers. Legitimate organisations generally don't ask for payment or sensitive details by email or text out of the blue. When money is involved, verify independently before doing anything.

Verify through independent channels

This is the habit that defeats most phishing. If a message claims to be from your bank, don't use the link or number in the message. Log in through the app or website you'd normally use, or call the number printed on your card. If it claims to be from a colleague, message them through your usual work channel. The few seconds to verify independently are what the attacker is trying to skip.

Use stronger sign-in where you can

Two habits dramatically reduce the damage phishing can do:

• Turn on two-factor authentication on important accounts, so a stolen password alone isn't enough.
• Use a passkey where offered — passkeys are bound to the real service and won't work on a fake login page, which removes the most common phishing path entirely.

What to do if you clicked

Don't panic, and don't ignore it. A few steps cover most situations:

• If you opened a suspicious link but entered nothing, you're usually fine. Run a reputable security scan if you're worried, and watch for odd account activity.
• If you downloaded an attachment, disconnect from the internet and run a security scan.
• If you entered a password on a fake page, change it immediately — starting with that account, then anywhere you reused it.
• Turn on two-factor authentication if it wasn't already on.

What to do if you entered a password

If you handed over credentials, act quickly but calmly:

1. Change the password for that account right now.
2. Change it anywhere else you used the same password.
3. Enable two-factor authentication on the account.
4. Check for unfamiliar sign-ins, forwarding rules or new devices, and sign out of other sessions.
5. If payment details were entered, contact your bank through a number you trust.

Speed matters more than perfection. Most damage from phishing happens in the hours after credentials are captured, so acting the same day is what limits it.

Phishing works by rushing you and leaning on trust. Slowing down, verifying independently, and using passkeys or 2FA takes away the leverage it relies on. For a wider look at everyday account security, The Digital Security Guide builds on these habits in more depth.

Free resource: Phishing Check — 10 Things to Check Before You Click