How to Spot Phishing Emails and Texts, and What to Do If You Click

Phishing is a message that pretends to come from a bank, delivery company, employer or government agency to trick you into clicking a link, opening a file or handing over money. Filters catch most of it, but not all, so knowing the warning signs is your best defence.

Seven warning signs

1. Urgency or threats. “Your account will be closed in 24 hours” is designed to make you act before you think.
2. A sender address that does not match. The display name may say “PayPal” while the address is something unrelated. On a phone, tap the sender’s name to see the full address.
3. Generic greetings. “Dear customer” from a company that normally uses your name.
4. Links that go somewhere else. The text of a link can say one thing while the destination is another.
5. Unexpected attachments. Invoices, voicemails and “documents to sign” you were not expecting.
6. Requests for payment in unusual forms. Gift cards, cryptocurrency, wire transfers or a new bank account for “your refund”.
7. A request to move the conversation. “Text me on WhatsApp” or “call this number” takes you outside the protections of your email provider.

How to check a link safely

• On a computer, hover over the link without clicking. The real destination appears at the bottom of the window.
• On a phone, press and hold the link to preview the address.
• Better still, do not use the link. Open your browser and type the company’s address yourself, or use its official app.
• Be cautious with QR codes in unexpected emails, letters or on stickers in public places. They hide the destination just as well as a shortened link.

What to do if you already clicked

You clicked but entered nothing. Close the page. Run a security scan if you are worried, and do not panic: on a modern, updated device, just visiting a page is rarely enough to cause harm.

You entered a password.

1. Change that password immediately, on the real site.
2. Change it anywhere else you used the same password, and stop reusing passwords.
3. Turn on two-factor authentication for the account.
4. Check the account’s recovery email, phone number and any forwarding or filter rules, which attackers sometimes add to keep access.

You entered card or bank details, or sent money. Call your bank or card issuer straight away using the number on the back of your card. The sooner you report it, the better the chance of stopping or reversing the payment. Also consider freezing your credit if you shared identity details.

You opened an attachment. Disconnect the device from the internet, run a full scan with your security software, and change passwords from a different, clean device.

Where to report phishing

Where	How
United States	ReportFraud.ftc.gov
United Kingdom	Forward emails to report@phishing.gov.uk, and texts to 7726
Anti-Phishing Working Group	Forward emails to reportphishing@apwg.org
Your email app	Use “Report phishing” so the provider can block it for others

A simple habit that beats most scams

If a message makes you feel rushed, worried or excited, stop. Contact the organisation directly through a phone number or website you already trust, and ask whether the message is real.