A phishing message is a fake email, text, or direct message that pretends to be from a company or a person you trust, and tries to get you to click a link, open a file, or hand over a password or payment details. The message usually creates urgency — an account will close, a parcel is waiting, a payment failed — so you act before you think. The defence is a pause: read it again, check the sender, and verify the claim another way.
The signs to look for
Start with the sender. The display name may say your bank, but the address behind it may be a string of random letters or a lookalike domain with one letter changed. On a phone, tap the name to see the full address. Many phishing messages use a generic greeting such as Dear Customer or odd spelling, though the better ones are well written, so clean spelling alone is not proof a message is real.
Check the link before you click it
On a computer, hover over a link to see where it really goes. On a phone, press and hold it to preview the address. A link that claims to go to your bank but points to a different domain, or a shortened link with no clear destination, should make you stop. If you are unsure, do not use the link at all. Open the company's app, or type the address yourself, and check there. Our pillar article on how to stay safe online: the habits that actually protect you puts this habit alongside the other basics.
What different phishing messages look like
- Delivery and parcel messages: a missed delivery, a fee to pay, or a link to reschedule. Real couriers rarely ask for payment by text, and they do not need your password.
- Account warnings: your account will be locked, your password has expired, or unusual activity was found. The fix is always a link, and the link is always the trap.
- Payment and refund messages: a refund is waiting, a subscription is about to renew, or a payment failed. Check in the app instead of clicking through.
- Messages from a friend: a short, urgent request for help or money, often from an account that has been taken over. Call the person before you send anything.
Our article on strong passwords and passkeys, explained in plain English explains why a stolen password is so damaging, and our piece on is public Wi-Fi safe? What to do before you connect covers the extra care worth taking on networks you do not control.
If you clicked or replied
Act quickly. Change the password for the account involved, from a device you trust, and turn on two-factor authentication if it was off. Check the account for changes you did not make, such as a new recovery email. If you entered card details, contact your bank and ask what to watch for. For more on keeping family accounts safe, see how to keep your kids safer online.
Key takeaways
- Pause before you click — urgency is the main weapon in a phishing message.
- Check the sender address, not just the display name.
- Hover over or press and hold a link to see where it really goes.
- No real company will ask for a password or payment by email or text.
- If you clicked, change the password, check the account, and report the message.
Frequently asked questions
How can I tell if an email is phishing?
Check the sender address, look for urgency or a request for passwords and payment, and preview any link before you click it. When in doubt, open the company's app or type its address yourself instead of using the link.
What should I do with a phishing text?
Do not click the link or reply. Report it through your phone or messaging app, delete it, and check the claim through the company's own app or website if it concerns an account you hold.
Can a phishing message come from a real account?
Yes. Attackers can take over a real account or spoof a sender, so a familiar name or thread is not proof. If a message from a friend asks for money or a password, contact them by another route first.
What happens if I clicked a phishing link?
Change the password for the account involved from a device you trust, turn on two-factor authentication, and check for changes you did not make. If you entered card details, contact your bank.
Phishing messages work because they look ordinary and arrive at busy moments. A short pause and a habit of going to the app instead of the link will catch most of them.
