Phishing: how to spot fake emails and messages

What phishing is

Phishing is a message pretending to be someone you trust, such as a bank, delivery company, your manager or IT support, to trick you into clicking a link, opening a file, sharing a password or paying money. It also arrives by text message (smishing) and phone call (vishing).

Warning signs

• Urgency or fear: "Your account will be closed today", "Pay now to avoid a penalty".
• Sender address doesn't match: a display name says "IT Support" but the address is a random domain.
• Links that don't go where they claim: hover over a link (or long-press on a phone) to see the real address.
• Unexpected attachments, especially zip files, documents asking you to "enable content", or invoices you weren't expecting.
• Requests for passwords, codes, gift cards or changes to bank details.
• Generic greetings and unusual spelling or grammar (though many phishing emails are now well written).

The golden rule: verify another way

If a message asks you to act, don't use the contact details in the message. Open the website yourself, or call the person or company using a number you already trust.

If you clicked or entered details

1. Don't panic, and don't hide it. Fast action limits damage.
2. Change the password from a safe device, and anywhere you reused it.
3. Make sure MFA is on, and sign out other sessions if the service allows it.
4. Tell your IT or security team straight away (or your bank, if money is involved).
5. If you opened an attachment at work, disconnect from the network and contact IT.

Real-world example: "please update our bank details"

In a small office, the person who pays suppliers receives an email that looks like it is from a regular supplier. The logo and signature look right. It says the supplier has changed banks and asks for this month's invoice to be paid into a new account, "urgently, before Friday".

She notices two things. The sender's address has one letter different from the real supplier's domain, and the request is about changing bank details, which is a classic warning sign. Instead of replying, she rings the supplier on the phone number already saved in the accounts system, not the number in the email. The supplier has not changed banks at all.

She reports the email to the person who looks after IT, who warns the rest of the team. The same pattern shows up at home as fake parcel-delivery texts asking for a small "redelivery fee".

Try this: open a genuine email from your bank or a shop and hover over a link without clicking. Compare the address that appears with the text of the link. Getting used to this check makes fakes easier to spot.