What phishing is
Phishing is an attempt to trick you into giving something away: a password, a verification code, payment details, or access to your device. The message pretends to come from someone you trust, such as a bank, a delivery service, a platform’s support team, a manager or a friend. It can arrive by email, text, a direct message on a social network, or inside a group chat.
The technique is old, but it keeps working because it targets attention and emotion rather than technology. A tired person who is rushing, worried or curious is easier to fool, however careful they usually are.
Common warning signs
No single sign proves a message is fake, and good fakes can avoid all of them. Still, these patterns come up often.
Pressure and urgency. Claims such as “your account will be closed today,” “act now,” or “final warning” are designed to stop you thinking. Legitimate organizations rarely demand immediate action through a chat message.
Unexpected requests. A message you were not expecting that asks you to log in, confirm details, pay a fee, or share a code deserves extra caution.
Requests for codes or passwords. A real support team does not normally ask you to read out a one-time code or password. Codes are meant for you alone, and sharing one is often how a takeover succeeds.
Odd links. Links can show friendly text while pointing elsewhere. Look for slightly misspelled names, extra words, strange endings, or shortened links that hide the destination. On many devices, you can press and hold, or hover, to preview the address before opening it.
Mismatched sender details. The display name may look right while the address, username or number is unfamiliar. In direct messages, a new account with a copied profile picture is a common sign.
Generic greetings and awkward wording. “Dear user” and unusual phrasing can be clues, though better-written fakes exist, including those written with the help of artificial intelligence tools, so clean wording is not proof of safety.
Unexpected attachments. Invoices, “documents,” voice notes or archives from unknown senders can carry harmful software or lead to a fake login page.
Too-good-to-be-true offers. Prizes, easy money and exclusive deals are common bait, as are fake job offers and requests to move a conversation to a different app.
Messages from people you know
One of the most effective versions arrives from a friend or colleague whose account has been compromised. The message may say “is this you in this video?” or ask for a quick favor, such as buying gift cards or sharing a code you just received. If a contact’s message feels out of character, check through another channel, such as a phone call or in-person conversation. This also explains why a hijacked account can quickly spread harm, as described in the guide to account takeover.
At work, a common pattern is a message that appears to come from a senior person asking for an urgent payment or a change of bank details. A rule that payment changes must be confirmed through a second, known route helps. Teams may add this to their guidance on handling sensitive information.
What to do when you are unsure
A simple routine works for most situations:
- Stop and do not click. Do not open attachments, scan codes or reply with details.
- Check the sender. Does the address, number or username really match? Is the message the kind this sender normally sends?
- Go to the source yourself. Open the official app or type the website address, rather than using the link in the message, and look for any real notice there.
- Verify through another channel. Contact the person or organization using details you already had, not details from the message.
- Ask someone. A colleague, family member or IT contact can give a second opinion. In a team, a shared place to report suspicious messages encourages people to ask rather than guess.
- Report and delete. Use the report or “mark as spam or phishing” option, and block the sender if appropriate.
If you already clicked or replied
Do not panic. The response depends on what you shared:
- If you entered a password, change it right away on the real service, and anywhere else you used it.
- If you shared a verification code, treat the account as at risk and follow a recovery routine like the one in the article on account takeover.
- If you opened an attachment or installed something, disconnect from the network if you can, run a security scan, and ask an IT contact for help.
- If you shared payment details or sent money, contact your bank or payment provider promptly. Rules and recovery options vary by place.
- Tell your team or contacts if their data or accounts could be affected.
Reducing your risk over time
Unique passwords and a second login check will not stop you from being tricked, but they limit what a stolen password can do. Keeping devices and apps updated also closes known weaknesses. Most important is a habit of slowing down for anything that asks for action, money or secrets. Broader cases of fraud involving fake profiles and offers are covered in the article on online scams, while the general principles of good judgment link to media literacy.