Phishing is not defined by poor spelling or a suspicious-looking logo. Modern scams can copy a real company’s design, use personal information, and arrive in an existing message thread. The reliable defense is to evaluate the request, the route it arrived through, and the action it wants you to take.
A phishing message tries to make you reveal information, send money, approve access, or run malicious software.
Understand the pressure behind the message
Most phishing messages create a reason to act before thinking.
Pay attention when a message asks you to:
- Sign in through an embedded link.
- Provide a password, verification code, Social Security number, or card details.
- Move a conversation to an unfamiliar channel.
- Buy gift cards, cryptocurrency, or wire a payment.
- Open an unexpected attachment or enable document macros.
- Install software, a browser extension, or remote-access tool.
- Scan a QR code to fix an account problem.
- Approve a multifactor authentication prompt you did not initiate.
The story may change, but the desired shortcut is similar: bypass the normal way you interact with the organization.
Treat urgency as a signal to verify
Urgency alone does not prove fraud. Banks and employers sometimes send real time-sensitive notices. The safe response is to verify through a separate path.
Do not use the phone number, link, or reply address supplied in the questionable message.
This independent verification defeats many sophisticated messages because it removes the attacker from the conversation.
Inspect the sender beyond the display name
A display name such as “Payroll” or “Bank Security” can be chosen by anyone. Expand the sender details and examine the complete address.
Even a correct address is not absolute proof. An account can be compromised, and attackers may send from a real mailbox. Compare the request with the sender’s normal behavior. An unexpected invoice or document from a known contact still deserves confirmation.
In email, the reply-to address may differ from the visible sender.
Read links without following them
On a computer, hovering over a link may reveal its destination.
For example, accounts.example.com belongs to example.com, while example.security-check.com belongs to security-check.com.
Shortened links hide the destination. QR codes do the same. Treat both as opaque until you can verify why they were sent. For an account notice, navigating independently is safer than decoding the link.
Know what HTTPS does—and does not do
A padlock indicates that the connection between the browser and site is encrypted and that a certificate was issued for the domain. It does not mean the business is honest or that the page is the company it imitates. Scam sites can use HTTPS.
Browser warnings about invalid certificates, deceptive sites, or dangerous downloads should not be bypassed merely because the page looks familiar. Leave the page and investigate through a separate source.
Evaluate the whole website
A copied page may look convincing at first glance. Test its context before entering information:
- Does the domain exactly match the organization’s known domain?
- Did you reach it through a message you did not expect?
- Does the site demand credentials before showing ordinary information?
- Are navigation links broken or do they all return to the same sign-in form?
- Does the page request information unrelated to the task?
- Is payment limited to irreversible or unusual methods?
- Are contact details missing, inconsistent, or copied from another business?
- Does the browser initiate a download or permission request unexpectedly?
Search results and online advertisements are not guarantees of legitimacy. Fraudulent sites may buy ads or manipulate search visibility.
Be cautious with attachments and shared documents
An attachment can be dangerous even if its icon resembles a PDF or invoice. File extensions may be hidden, and names can include misleading words. Unexpected archives, executable files, disk images, scripts, or macro-enabled office documents deserve special caution.
Cloud-sharing invitations can also lead to fake sign-in pages. A message may claim that a document is waiting, then ask for email credentials on a page controlled by the attacker. Access the cloud service independently and check whether the document appears in your account.
Keep the operating system, browser, security software, and document applications updated.
Protect credentials so one mistake is less damaging
Use a unique password for every important account and store passwords in a reputable password manager. Reusing a password turns one stolen credential into access to multiple services.
Enable multifactor authentication, preferably a phishing-resistant method such as a security key or passkey when available.
Protect the email account especially carefully. Email often controls password resets for other services. Review recovery addresses, phone numbers, forwarding rules, app passwords, and active sessions periodically.
Use a short verification routine
When a message creates doubt, stop and use five checks:
- Context: Did you expect this message or action?
- Identity: Can you verify the sender through a known channel?
- Destination: Does the actual domain match the claimed organization?
- Request: Is the information, payment, download, or access appropriate?
- Consequence: What could happen if the request is fraudulent?
High-consequence actions deserve slower verification.
Report suspicious messages safely
Use built-in “report phishing” or spam tools from the email, phone, or messaging provider. Organizations often publish a security or abuse address for impersonation reports.
Do not forward a suspicious attachment casually to coworkers or friends. A screenshot or a report through the security team’s approved process is safer.
Then delete the message from the inbox and trash after reporting, unless an investigator asks you to preserve it.
If you clicked but entered nothing
Close the page. Do not download or install anything it offers. If a file downloaded automatically, do not open it.
Run the security scans recommended for your device and update software. Review the browser’s download list, extensions, notification permissions, and newly installed applications. Clearing history alone does not remove malware.
A click does not always mean compromise, but quick, accurate reporting gives defenders more information.
If you entered a password or code
From a trusted device, go directly to the real service and change the password immediately. If that password was reused, change it everywhere else, beginning with email, banking, and password-manager accounts. Sign out other sessions and revoke unfamiliar devices or connected apps.
Enable or reset multifactor authentication and save new recovery codes securely. Check whether recovery email, phone, forwarding, filters, or payment details were changed. The FTC’s account-recovery guidance provides additional steps for compromised email and social accounts.
If financial information was entered, contact the card issuer or financial institution using a verified number. Monitor statements and follow its fraud procedures. If identity information was exposed, use IdentityTheft.gov for a recovery plan.
If you sent money or installed software
Contact the payment provider immediately and ask whether the transaction can be stopped or recalled. Speed matters, but recovery is not guaranteed. Preserve receipts, messages, numbers, domains, and timestamps for reports.
If remote-access software was installed, disconnect the device from networks and seek qualified technical help. Do not continue banking or changing passwords on a device that may still be controlled. A workplace device should be handled under the organization’s incident-response process.
Build habits instead of relying on instinct
No one reliably detects every phishing attempt by appearance.
The safest question is not “Does this message look professional?” It is “Can I confirm this request without using anything the message gave me?” That shift turns skepticism into a practical action and works even when the phishing message looks polished.
