How to Spot Phishing Emails, Texts and Fake Websites

Phishing is when an attacker pretends to be someone you trust, such as your bank, a delivery company, a government agency or your employer, to trick you into handing over passwords, card numbers or one-time codes. It remains the most common way ordinary accounts get compromised because it targets people, not software. The good news is that most phishing attempts share recognisable patterns.

The common forms

• Email phishing: a message that looks like it comes from a service you use, with a link or attachment.
• Smishing: the same trick by SMS or messaging apps, often about parcels, unpaid tolls, or "suspicious activity".
• Vishing: phone calls from a "bank security team" asking you to confirm a code or move money.
• Spear phishing: a targeted message that uses real details about you or your company.
• Fake websites: a copy of a login page hosted on a lookalike domain.

Seven warning signs

1. Urgency or threats

"Your account will be closed in 24 hours." Scammers create pressure so you act before thinking. Real organisations rarely demand immediate action through a link.

2. A sender address that doesn't quite match

The display name may say "Your Bank", but the actual address might be [email protected]. Look at the domain after the @ sign. Lookalikes swap letters (rn for m), add hyphens, or use unusual endings.

3. Links that go somewhere else

Hover over a link (or long-press on a phone) to preview the real destination before you open it. If the text says one site and the preview shows another, don't click. Shortened links hide the destination entirely and deserve extra suspicion.

4. Generic greetings and odd wording

"Dear customer" instead of your name, awkward grammar, or strange formatting are clues, though polished AI-written scams are making this sign less reliable. Don't treat good grammar as proof of legitimacy.

5. Unexpected attachments

Invoices you never ordered, "voice messages" and zipped files can carry malware. Be especially wary of Office documents that ask you to "enable macros" or "enable editing".

6. Requests for sensitive data

Legitimate companies do not ask you to email your password, PIN, full card number or an OTP. Anyone who asks for a one-time code is almost certainly trying to log into your account at that moment.

7. Too good to be true

Surprise refunds, prizes, job offers with huge pay for little work, and investment tips from strangers are classic bait.

How to check a suspicious message safely

1. Don't use the contact details in the message. Open the company's official app or type its address yourself.
2. Look at the full sender address and the real link destination.
3. Search the exact wording of the message online; common scams are often reported.
4. Check the website's domain carefully. A padlock only means the connection is encrypted; scammers get certificates too.
5. When in doubt, call the number printed on your card or the official website.

Habits that protect you even when you slip

• Use a password manager. It autofills only on the correct domain, so a fake site won't get your password. If it doesn't offer to fill, treat that as a warning.
• Turn on two-factor authentication, preferably with an authenticator app or a passkey instead of SMS codes.
• Keep your browser and operating system updated so known exploits are patched.
• Use a different password for every account, so one leak doesn't unlock everything.

What to do if you already clicked or entered details

1. Don't panic, and act quickly. Disconnect from the network if you downloaded something suspicious.
2. Change the password for the affected account, and for any other account that used the same password. Do it from a different, trusted device if possible.
3. Sign out of all sessions in the account's security settings and review recent activity.
4. Contact your bank immediately if card or banking details were shared, and ask to block or reissue the card.
5. Run a malware scan if you opened an attachment.
6. Report it. Forward phishing emails to your email provider's report option, and report fraud to your national cybercrime authority. In India, this can be done through the National Cyber Crime Reporting Portal or by calling 1930.

The mindset that works

Treat unexpected messages as unverified until proven otherwise. Slow down, go to the source directly, and remember that no genuine service will be harmed by you taking two minutes to check. That pause is the single most effective defence against phishing.