Spot the Phishing Message Before You Tap

Recognize the pressure

Phishing messages imitate a bank, delivery company, employer, or someone you know to make you reveal information, open a file, or pay quickly. Urgency, unexpected attachments, threats, prizes, and requests to bypass normal procedures deserve scrutiny. Polished spelling and familiar logos are not proof of authenticity; attackers can copy public branding and personal details. A message can arrive by email, text, social media, or a phone call.

Verify outside the message

Do not use the message's link or phone number to check a surprising request. Open the organization's official app, type a known web address yourself, or call a number from a statement or card. On a computer, inspect a link's actual destination before opening it; on a phone, press and hold only if your device safely previews the address. Never share a one-time code with a person who contacted you.

If you already interacted

If you entered a password, change it from the genuine service, change any reused copies, and review active sessions and recovery information. Contact your bank through its verified channel if payment or financial details were involved. Report the message using your mail or messaging app's reporting feature, then delete it. Keeping software updated and enabling multifactor authentication can reduce harm, but careful verification remains the best response to an unusual request.

Sources and further reading

• CISA: Recognize and Report Phishing
• FTC: Phishing Scams