A message arrives that looks urgent. Your bank says your account will be closed. A delivery company says a parcel is waiting, but a small fee is due. Your boss asks you to buy gift cards quickly and keep it quiet. Each message looks official, uses the right logo, and pushes you to act now. That is exactly how phishing works — and why it catches out smart, careful people every day.
Phishing is one of the most common online scams in the world, but it has clear warning signs once you know what to look for. This guide explains how phishing works, the forms it takes, and a simple routine you can use to check any suspicious email, text, or website before you click.
What Is Phishing, in Plain English?
Phishing is a trick. A criminal pretends to be a trusted organisation or person — a bank, a tax office, a delivery firm, a streaming service, or even a colleague — and contacts you with a fake message. The goal is to make you click a harmful link, open a dangerous attachment, hand over passwords or card details, or send money.
The fake link usually leads to a copycat website that looks like the real login page. If you type in your details, they go straight to the scammer, who can then sign in as you. Other messages install harmful software, or start a conversation that persuades you to transfer money. The message is the bait; your trust and your hurry are what the scammer is fishing for.
The Main Types of Phishing to Know
Email phishing
This is the classic form: bulk emails sent to thousands of people, hoping a few will bite. Common themes include failed deliveries, unusual sign-ins, expiring subscriptions, refunds, invoices you do not recognise, and warnings that an account will be suspended unless you verify it immediately.
Text message phishing, or smishing
Fake texts often claim a parcel needs redelivery, a bank payment was blocked, or a toll, fine, or tax bill is unpaid. They include a link with a short deadline. Because texts feel personal and are read quickly, people tap before they think.
Voice phishing, or vishing
A caller claims to be from your bank, a technology company, or the police, and says your money is at risk. They may ask you to move money to a safe account, install software, or read out a security code. A real bank will never ask you to do any of these things.
Targeted and workplace phishing
Spear phishing is aimed at a specific person using details from social media or company websites. In workplaces, criminals impersonate senior staff or suppliers, asking for payments or changes to bank details. A short, urgent request from the chief executive should always be checked through another channel.
Fake websites and adverts
Scammers also buy search adverts and create lookalike shops offering deals that seem too good to miss. You pay for goods that never arrive, or enter card details on a site built only to steal them.
12 Warning Signs of a Phishing Message
No single sign proves a message is fake, but several together should stop you in your tracks. Run through this list whenever a message asks you to click, pay, or share information.
- Unexpected contact: You were not expecting a refund, parcel, invoice, or security warning.
- Urgency and threats: Phrases like act now, your account will be closed, or legal action push you to skip checking.
- A sender address that does not match: The display name looks right, but the actual email address or phone number is slightly different or completely unrelated.
- Strange links: The link text says one thing, but the real destination is a misspelled or unfamiliar address.
- Generic greetings: Dear customer or Dear user instead of your name, especially from a company that normally addresses you personally.
- Spelling and layout errors: Not every scam has them, and polished scams exist, but sloppy wording is still a clue.
- Requests for secrets: Any message asking for your full password, PIN, or one-time code is a scam. Legitimate organisations do not ask for these by email or text.
- Unusual payment methods: Requests for gift cards, cryptocurrency, wire transfers, or payment to a new bank account are major red flags.
- Unexpected attachments: Invoices, receipts, or documents you did not ask for can carry harmful software.
- Too-good-to-be-true offers: Huge prizes, unlikely refunds, and investment returns that sound guaranteed are bait.
- A tone that does not fit: A message from a friend or manager that sounds unlike them deserves a check.
- Pressure to keep it secret: Scammers isolate victims so nobody can warn them.
How to Check a Link or Website Safely
You do not need special tools to check a link — you need a pause and a different route. The safest rule is simple: do not use the link or phone number in the message at all. Instead, open the company’s official app, or type its known web address into your browser yourself, or call the number printed on your bank card or a paper statement.
- On a computer, hover over a link without clicking to see its true destination at the bottom of the window. Look carefully at the main part of the address: extra words, swapped letters, or a different ending are danger signs.
- On a phone, press and hold a link to preview it, but if you have any doubt, do not open it. Go to the official app instead.
- Check the website carefully if you do land on one. A padlock icon only means the connection is encrypted; it does not mean the site is genuine. Scam sites can have padlocks too.
- Never enter a one-time code on a page you reached from a message, and never share a code with a caller. Those codes are for you alone.
- Search for the exact wording of a suspicious message. Many scams are widely reported, and you may find warnings from the real organisation.
What to Do If You Receive a Phishing Message
If a message feels wrong, stop and do nothing in haste. Do not click links, open attachments, reply, or call numbers in the message. In your email app, use the report phishing or junk option, which helps providers block similar messages for others, then delete it. If the message impersonates your employer, alert your IT or security contact so colleagues can be warned.
What to Do If You Think You Clicked
Act quickly, but calmly. If you entered a password on a fake site, go to the real site yourself and change that password immediately, and change any other account where you reused it. Turn on two-factor authentication. If you entered card or bank details, contact your bank using the number on your card and explain what happened; they can watch for fraud or replace the card. If you sent money, report it to your bank and to the police or your national fraud reporting service straight away — speed sometimes helps recover funds. If you opened an attachment or installed something, disconnect from the internet and run a trusted security scan, or get professional help. Keeping a note of what you clicked, entered, and when will help everyone assisting you.
Frequently Asked Questions
Can phishing happen on social media?
Yes. Fake prize draws, copied profiles of friends, and messages claiming your account will be deleted are common on social platforms. Apply the same checks: go to the official app, question urgency, and never share login codes.
What if the message uses my name and looks perfect?
Criminals can personalise messages using data from breaches and social media, and modern tools make scam wording very polished. Personal details do not prove a message is real. Always verify through an official route you chose yourself.
Should I reply to ask if a message is genuine?
No. Replying confirms your address is active and may start a persuasive conversation with the scammer. Contact the organisation separately using details from its official website or app.
Is it safe to unsubscribe from suspicious emails?
No — it is still a link in a scam message. Report it as phishing or junk and delete it instead.
Conclusion: Pause, Check, and Go Direct
Phishing succeeds when you are rushed, worried, or distracted. It fails when you pause. Remember the routine: question unexpected urgency, check the sender and the link, and always go direct to the official app, website, or phone number you trust. Share these habits with family and colleagues, because one warned person can protect many others.
Want clear, practical online safety guides without the jargon? Subscribe to Go Digital Professional for weekly tech tips that help you spot scams, protect your accounts, and use technology with confidence.