Phishing is a scam designed to make you hand over passwords, payment information or access to your accounts. The attacker may pose as your bank, a package delivery company, a coworker or a familiar online service. Many attempts now look polished and well written.
Five signals worth checking
1. Unrequested urgency
Messages that claim your account will disappear in minutes, demand immediate payment or threaten a penalty are designed to reduce your willingness to check. Real problems can be urgent, but urgency alone is never proof a message is authentic.
2. The actual destination URL
Display text and logos can be copied. Before signing in or paying, inspect the web address carefully and use your own bookmark or manually open the organization's known website. Watch for extra characters, misleading subdomains and unusual domains.
3. Requests for secrets
Never share one-time authentication codes or recovery keys because a caller or message tells you to. If someone claiming to be support asks you to read a verification code aloud, stop and contact the company through its established app or website.
4. Unexpected attachments or software requests
An attachment that tells you to enable macros, install a special viewer or bypass security warnings deserves extra scrutiny. Do not run unfamiliar software just to view a supposedly important document.
5. A channel that does not match the request
If a message appears to come from a colleague asking for a bank transfer, confirm through a separate trusted channel. A compromised email account can make even real-looking correspondence dangerous.
What to do when a link looks suspicious
- Do not click the sign-in or payment link.
- Open the service through your own bookmark, typed address or official app.
- Check recent activity and notifications inside the account.
- If the issue appears legitimate, contact support using the provider's published channel.
- Report the phishing message through your email or messaging service.
What if you already clicked?
A click by itself does not always mean a device is infected. If you entered credentials, change the password from a trusted device, revoke suspicious sessions and enable multifactor authentication. If you downloaded and executed software, disconnect affected systems where appropriate and obtain professional assistance if business or financial data is involved.
Where security tools help
Browser malicious-site filtering and antivirus scanning may block known phishing pages and malicious files. They cannot guarantee recognition of every new scam. An encrypted VPN does not prevent you from trusting a fraudulent website. Human verification remains essential.
Rule worth keeping: The safest route to a sensitive account is one you initiate yourself, rather than a sign-in link contained in an unexpected message.