What Phishing Actually Is
Phishing is an attempt to trick someone into handing over sensitive information — passwords, card numbers, one-time codes — or into installing malware, usually by impersonating a trusted sender or organization. It arrives most often as email, but text messages ('smishing'), phone calls ('vishing'), and fake websites are all common variants of the same basic trick.
Mismatched or Suspicious Sender Addresses
The display name on an email can say anything the sender wants, regardless of the actual address behind it. Checking the full email address — not just the friendly name — often reveals a domain that only resembles the real company, such as extra words, misspellings, or an unrelated domain entirely.
Urgency and Pressure Tactics
Messages that create artificial urgency — 'your account will be suspended in 24 hours,' 'unusual sign-in detected, verify immediately' — are designed to short-circuit careful thinking. Legitimate organizations rarely demand instant action through email or text for account security issues; they typically direct you to sign in through the official app or website at your own pace.
Generic Greetings and Odd Phrasing
Mass phishing campaigns often use generic greetings like 'Dear Customer' rather than an actual name, and may contain phrasing that feels slightly off — awkward grammar, unusual formatting, or a tone that doesn't match how the organization normally communicates. Well-crafted phishing has improved over time, so this signal isn't reliable on its own, but it remains a useful supporting clue.
Links That Don't Match Where They Claim to Go
Hovering over a link (without clicking) on a computer, or pressing and holding on mobile, usually reveals the actual destination URL. If it doesn't match the organization it claims to be from, or uses a shortened link service to obscure the destination, treat it as a warning sign.
Unexpected Attachments
An unexpected attachment, especially one requiring you to 'enable content' or macros in a document, is a common malware delivery method. Legitimate invoices, shipping notices, or account statements are rarely sent as unsolicited attachments from unfamiliar senders.
Requests for Credentials or Payment Information
No legitimate bank, payment provider, or major service will ask for a full password, PIN, or one-time authentication code via email or text. If a message asks for this directly, or links to a page requesting it, treat it as fraudulent.
What to Do If You Suspect Phishing
- Don't click links or open attachments in the suspicious message.
- Go directly to the organization's website by typing the address yourself, or use their official app, rather than clicking through the email.
- Report the message using your email provider's 'report phishing' option, which helps improve spam filtering for everyone.
- If you already entered credentials on a suspicious page, change that password immediately and enable multi-factor authentication if it isn't already on.
- Delete the message once handled.