How to Spot Phishing Emails and Fake Messages

Phishing is a scam that pretends to be a bank, a delivery company, a government office or a colleague, and tries to get you to click a link, open a file or share information. Modern phishing messages are often well written, so it is important to know what to check rather than relying on spelling mistakes.

Common signs

A message that creates urgency, such as "your account will be closed in 24 hours".
A greeting that does not use your name, or uses a name that does not match your account.
A request to confirm a password, PIN or payment details by email or text.
An unexpected attachment, especially a zip file or a document that asks you to enable macros.
A sender address that looks almost right but has a small change, such as an extra letter or a different domain.

Check links before you click

Hover over a link on a computer to see the real address at the bottom of the window. Look at the domain name, which is the part just before the first single slash after the protocol. A link to "secure-bank.example.net" leads to example.net, not to a bank. When in doubt, type the website address yourself or use the official app.

Do not trust the caller ID or the logo

Sender names and logos are easy to copy. If a message seems important, contact the company using a phone number or website you already know, not one given in the message.

What to do if you clicked

If you entered a password, change it at once on that site and any other site where you used it.
Turn on two-factor authentication, if you have not already.
If you shared bank details, contact your bank immediately using its official number.
If you opened an attachment, run a security scan and see what malware is and how to remove it.

Report and delete

Report the message as phishing in your email app, which helps filter future messages. Then delete it. Do not reply, even to say "stop".

Frequently asked questions

Are text message scams the same?

Yes. Many scam texts ask you to click a link to pay a small fee or track a parcel. Treat them the same way: do not click links you did not expect.

Can phishing reach my work email?

Yes. Organisations often run training and filters. Report suspicious messages to your IT team rather than dealing with them alone.

Watch for urgent requests to act

Phishing often asks you to act quickly, pay a fee, verify an account or confirm a delivery within hours. Real organisations rarely demand immediate action through an email link. If you feel rushed, stop and check the request through the official website or app before doing anything else.

Be careful with QR codes

Some phishing campaigns use QR codes instead of links, so the address is hidden until you scan the code. Before you open a page from a QR code in an unexpected message, check where it goes. Treat QR codes in emails and printed notices with the same care as links.