Phishing is a scam technique that tricks people into sharing information, opening malicious links, downloading unsafe files, or sending money. You can spot many attempts faster by slowing down, checking the sender, inspecting the link destination, and refusing urgent requests that bypass normal procedures.
TL;DR: Treat unexpected urgent messages as suspicious. Do not click links from pressure-filled emails or texts. Go directly to the official website or app, enable MFA, and report suspected phishing.
What phishing looks like now
Phishing is no longer limited to badly written emails. It can arrive through text messages, social media messages, phone calls, fake ads, QR codes, collaboration tools, and spoofed websites. Attackers often imitate banks, delivery companies, employers, schools, software tools, payment services, or government agencies.
CISA describes phishing as attempts to get people to open harmful links, emails, or attachments that may request personal information or infect devices. The FTC explains that scammers use email or text messages to try to steal passwords, account numbers, Social Security numbers, or other sensitive information. NIST also reminds small businesses that phishing is not limited to email and can occur through texts, phone calls, social media, and even physical mail. For practical guidance, review CISA's page on recognizing and reporting phishing, the FTC's guide on how to recognize and avoid phishing scams, and NIST's small business page on phishing.
The pressure pattern is the giveaway
Most phishing messages try to interrupt judgment. They create fear, urgency, curiosity, greed, or embarrassment. A message may say your account will close, a package is stuck, a payment failed, your boss needs gift cards, or a document is waiting.
The exact story changes, but the pattern is consistent: act quickly, use this link, do not verify through normal channels, and provide something valuable. When a message pushes you to skip ordinary checks, pause.
Check the sender, but do not trust it completely
Sender names can be spoofed or misleading. A message may display a familiar company name while coming from an unrelated address. On phones, short previews can hide important details. In work tools, a compromised account can send messages that look legitimate because they come from a real coworker.
Check the full sender address, but do not stop there. Ask whether the request fits the relationship, timing, tone, and normal process. If your bank needs information, go directly to the bank's app or website. If your manager asks for an unusual payment, verify through another channel.
This is where a good digital filing system helps. When you know where official account records, invoices, and contact details live, you are less likely to rely on a link inside a suspicious message.
Inspect links before opening them
On a computer, hover over a link to preview the destination. On a phone, long-press carefully if the device gives a safe preview option, but avoid opening the link. Look for misspellings, extra words, strange domains, unexpected URL shorteners, and mismatches between the displayed text and actual destination.
Do not assume a lock icon means the site is trustworthy. It only indicates an encrypted connection to that site. A fake website can still use HTTPS.
If the message claims to be from a service you use, open the app or type the known address yourself. Search results and ads can also be abused, so use bookmarks for critical accounts such as banking, email, cloud storage, and domain registrars.
Watch attachments and fake login pages
Phishing attachments may pretend to be invoices, resumes, shipping labels, tax forms, scans, or shared documents. They may ask you to enable macros, sign in again, or download a viewer. Treat unexpected attachments with caution, especially when the sender pressures you.
Fake login pages are common because passwords are valuable. If a link opens a page asking for credentials, stop and verify the URL. If you already typed a password into a suspicious page, change it from the real site and enable MFA immediately.
CISA's MFA guidance explains that MFA may be called two-factor authentication, two-step authentication, or similar, and that users should look for it in account security settings. See CISA's turn on MFA guidance for the basic steps.
Phishing red flags and safer responses
| Red flag | Why it matters | Safer response |
|---|---|---|
| Urgent account threat | Pushes fast action | Visit the account directly |
| Unexpected attachment | May contain malware | Confirm with sender first |
| Payment or gift card request | Common fraud pattern | Verify by phone or known channel |
| Misspelled domain | May imitate a real brand | Do not click, report it |
| Login request from a link | Captures credentials | Use the official app or bookmark |
| Too-good offer | Triggers curiosity or greed | Ignore or verify independently |
What to do if you clicked
If you clicked but did not enter information, close the page, avoid downloading anything, and run a security scan if something seems wrong. If you entered a password, change it from the real website. If you reused that password elsewhere, change those accounts too. Turn on MFA. If payment information was shared, contact the bank or card issuer quickly.
Report the message using your email provider, workplace process, or the relevant agency. The FTC page linked above includes reporting guidance for consumers, and CISA offers practical reporting advice as well.
Teach yourself a short pause habit
The goal is not paranoia. The goal is a repeatable pause. Ask four questions before acting:
- Was I expecting this?
- Is the sender and link consistent with the real organization?
- Is the message pressuring me to skip normal steps?
- Can I verify through a known app, bookmark, or phone number?
If the answer feels uncertain, do not click. Verification takes less time than recovering a stolen account.
This habit also protects network and device decisions. For example, if you recently upgraded coverage after reading the mesh Wi-Fi vs extender guide, remember that better connectivity does not protect you from fake login pages. Security still depends on account habits.
Make phishing harder to exploit
Use a password manager, unique passwords, MFA, software updates, and separate admin accounts where appropriate. Keep recovery emails current. Remove old devices from sensitive accounts. Teach family members or staff how to report suspicious messages without shame.
Your safest default
When a message asks for credentials, money, personal data, or urgent action, leave the message and go to the official channel yourself. Your next step is to enable MFA on your most important accounts and create a habit of verifying requests before clicking.
