How to Spot a Phishing Email or Text Message

Phishing is one of the most common ways ordinary people lose access to accounts or money. The good news is that you don't need to spot every fake message — you just need to recognise a small set of patterns and build a couple of habits that make the common tricks much less effective.

This is a calm, practical guide. The aim is not to make you anxious; it's to make you harder to fool.

Urgency

Phishing almost always creates pressure. "Your account will be closed in 24 hours." "Payment failed — act now." "You have an unpaid toll." Urgency is designed to make you act before you think.

The single most useful habit is to treat urgency as a signal to slow down, not speed up. Legitimate organisations rarely require an instant response under threat.

Impersonation

The sender will often claim to be someone you trust: your bank, a delivery service, a government body, a colleague or a familiar brand.

Look past the logo and the friendly tone. The question is always the same: is this actually from them?

Names and display text are easy to fake. Look at the full sender address, but remember that even a convincing address is only one clue.

When in doubt, don't reply — verify another way.

Unexpected requests

Be cautious of anything you weren't expecting: a package you didn't order, an invoice you don't recognise, a security alert for a login you didn't make, or a message from a friend that feels slightly off.

Unexpected doesn't automatically mean fraudulent, but unexpected + asks you to act is always worth checking.

Suspicious links

Before clicking, hover over a link on desktop or long-press on mobile to preview where it actually goes.

Watch for:

• slightly altered names
• strange or unrelated domains
• long, random-looking addresses
• domains that imitate a familiar brand but are not the real one

If you're not sure, don't click. Go to the service directly instead.

Fake login pages

A common goal of phishing is to capture your username and password on a convincing imitation of a real login page.

The defence is simple: never reach a login page by clicking a link in an unexpected message.

Type the address yourself, use a trusted bookmark, or open the organisation's official app.

That habit removes a large part of the risk.

Attachments

Unexpected attachments — especially invoices, receipts or documents from people you don't know — can carry malware.

Don't open attachments you weren't expecting, and be cautious even when the sender seems familiar. If a colleague sends something unusual, confirm it through another channel first.

Payment and sensitive-information requests

Be especially careful with messages asking you to:

• pay an overdue bill
• confirm card details
• move money
• buy gift vouchers
• provide passwords or security codes
• share banking or other sensitive information

If money or sensitive data is involved, verify independently before doing anything.

Don't rely on poor spelling as a warning sign

Scam messages are often much more polished than they used to be.

They can use convincing branding, professional language and realistic formatting.

So don't assume:

It looks professional, therefore it must be genuine.

Focus on what the message is asking you to do and whether that request makes sense.

Notice the emotion the message is trying to create

Sometimes the biggest clue isn't technical at all.

Does the message make you feel panicked, frightened, excited, pressured or unusually curious?

Scammers benefit when emotion takes over before careful thinking does.

If a message is making you feel rushed, treat that as another reason to stop and verify.

The most important rule: verify independently

If a message claims to be from your bank, don't use the link or telephone number in the message.

Open the bank's official app, type the known website address yourself, or call a trusted number printed on your card.

If the message claims to be from a colleague, contact them using the method you normally use.

A useful rule is:

Don't investigate a suspicious message through the suspicious message.

This is one of the habits that defeats most phishing attempts.

Use stronger sign-in where you can

Two habits dramatically reduce the damage phishing can do:

• Turn on two-factor authentication on important accounts, so a stolen password alone isn't enough.
• Use a passkey where offered — passkeys are tied to the real service and are much harder to phish.

What to do if you clicked

Don't panic, and don't ignore it. What you should do depends on what happened next.

• If you opened a suspicious link but entered nothing, you're usually at much lower risk. Watch for unusual activity and run a reputable security scan if appropriate.
• If you downloaded an unexpected attachment, run a security scan and follow your organisation's IT process if this happened at work.
• If you entered a password on a fake page, change it immediately — starting with that account, then anywhere you reused it.
• Turn on two-factor authentication if it wasn't already enabled.
• If you entered payment details, contact your bank using a number you trust.

What to do if you entered a password

If you handed over credentials, act quickly but calmly:

1. Change the password for that account immediately.
2. Change it anywhere else you used the same password.
3. Enable two-factor authentication.
4. Check for unfamiliar sign-ins, forwarding rules or new devices.
5. Sign out of other sessions where appropriate.
6. If payment details were involved, contact your bank through a trusted route.

Speed matters more than perfection.

How to report suspicious messages in the UK

If you're in the UK and receive an email you think may be a scam, you can forward it to the National Cyber Security Centre at report@phishing.gov.uk.

Suspicious text messages can usually be forwarded to 7726 free of charge.

If you've lost money or believe you've become a victim of fraud, reporting the message itself is not the same as reporting the crime. Contact your bank promptly where money or banking details are involved and use the appropriate fraud-reporting route for your situation.

Remember: Stop. Check. Confirm.

You don't need to become an expert in every phishing technique.

You need a routine that gives you enough time to notice when something is wrong.

If a message is unexpected, urgent or asking you to do something sensitive:

Stop before acting.

Check the sender, request and context.

Confirm through a trusted route that does not rely on the message itself.

That small pause can make your digital life considerably safer.

Not sure about a message you've received?

Use Aurelle Digital's free Phishing Check to work through the warning signs before you click.

For more practical help protecting your accounts and everyday digital life, explore The Digital Security Guide.