How to Spot Phishing When the Message Looks Convincing
- What the Message Wants From You
- Leave the Message Before You Solve Its Problem
- The Logo Can Be Perfect and the Address Wrong
- The Verification Code Can Be Part of the Trap
- QR Codes and Attachments Deserve the Same Pause
- Let Your Password Manager Be Unimpressed
- Already Clicked? Start With What Happened
- Give Yourself Permission to Check
According to your inbox, your bank account is frozen, your parcel is stranded, and your boss needs gift cards immediately. Phishing is very good at giving you a busy afternoon.
What the Message Wants From You
Phishing is an attempt to trick you into handing over information, money, or access by pretending to be someone you trust. It can arrive through email, texts, direct messages, phone calls, or a familiar account that has been compromised.
The story gets your attention; the requested action does the damage. Look for the moment a message asks you to enter a password, make a payment, approve a login, or open something unexpected.
| The story | What the scammer may want | How to check |
|---|---|---|
| Your parcel needs a small fee | Card details or payment | Open the courier's official app |
| Your account has been locked | Password and verification code | Visit the service through a saved bookmark |
| Someone shared a document | A login or an opened attachment | Contact the sender through a known channel |
| Your boss needs an urgent favor | Money, gift cards, or work information | Call the number you already have |
A tiny delivery charge can be an invitation to hand over much more valuable card details.
Good spelling doesn't settle anything. A polished message can be malicious, so focus on whether the request makes sense and whether you can confirm it independently.
Leave the Message Before You Solve Its Problem
The FTC recommends checking suspicious requests through a website or phone number you know is real. Open the official app, use an existing bookmark, or call a saved contact.
Caller ID can be spoofed too. If someone calls claiming to be your bank, hang up and use the number on your card or statement.
Pressure to act immediately, keep a request secret, or ignore the usual approval process deserves a pause. A supposed emergency doesn't make a new payment instruction more trustworthy.
The Logo Can Be Perfect and the Address Wrong
A fake page can copy the colors, logo, and layout of a real service. HTTPS encrypts your connection to that page; it doesn't certify that the person running it is your bank.
Compare these example addresses: accounts.example.com sits under example.com, while example.com.signin.example.net sits under example.net. The reassuring name at the beginning doesn't determine who controls the address.
On a phone, expand the address bar before entering anything sensitive. If the address is unfamiliar, use the official app or a saved bookmark.
A VPN Can Deliver Information to the Wrong Person
A VPN encrypts covered traffic between your device and its server, reducing what your local network can see. The provider forwards the traffic, and the destination normally sees the VPN server's public IP.
If that destination is a phishing page, it still receives whatever you submit. Encryption can protect the delivery of a password to an attacker without making that delivery a good idea.
The Verification Code Can Be Part of the Trap
Some fake pages relay your password to the real service. When that service requests a one-time code, the fake page asks you for it and relays the answer too.
A familiar second screen can make the trap feel more official. A code being temporary doesn't stop someone using it immediately.
Keep multifactor authentication enabled. It blocks many attacks involving a stolen password, but NIST distinguishes manually entered codes from phishing-resistant authentication because those codes can be relayed.
Passkeys and FIDO security keys bind authentication to the legitimate service's domain. That helps resist fake-site login attacks without relying on you to spot every convincing imitation.
The YubiKey 5C NFC supports FIDO sign-ins through USB-C or NFC on compatible services. Register a spare or another supported recovery method and store recovery codes safely before depending on it.
- Connects through USB-C or NFC, covering many newer computers and compatible phones
- Adds a phishing-resistant physical check to passkeys and supported multi-factor logins
- Works without a battery, code display, or wireless pairing process
A secure sign-in can't stop you sending money to someone who has talked you into it.
QR Codes and Attachments Deserve the Same Pause
A QR code can conceal an unfamiliar link behind a convenient square. The FTC warns about codes placed over legitimate ones, including on parking meters.
Preview the destination before opening it. For an unexpected payment or account request, use the official app or known website rather than trusting the printed logo beside the code.
Attachments can take a different route: an apparent invoice asks you to enable content, or a fake update asks you to install software. Verify unexpected files with the sender through an established contact method.
Don't install remote-support software or device-management profiles at an unsolicited caller's request. Keep your browser, operating system, document reader, and security software updated so a convincing message has fewer opportunities to exploit old bugs.
Let Your Password Manager Be Unimpressed
Your password manager doesn't care how convincing the logo looks. It associates saved credentials with website addresses, so missing autofill can be a useful reason to check where you landed.
Autofill can fail for harmless reasons too; it isn't a scam detector. Open the saved website rather than automatically copying your password into the unfamiliar page.
Use unique passwords so one stolen login doesn't unlock several accounts. Otherwise, a phisher who gets one password also gets a reason to try it everywhere else.
Already Clicked? Start With What Happened
Opening a message, entering a password, and installing an app need different responses. Focus on what you shared or approved, rather than treating every click as the same incident.
Entered a password: Change it on the real site using a trusted device, and replace it anywhere you reused it.
Shared a code or approved a login: Revoke unfamiliar sessions and use the account's sign-out controls; changing the password may not end every active session.
Account compromised: Check recovery details and email forwarding rules for unauthorized changes, and enable stronger MFA; use the provider's recovery process if locked out.
Shared financial details or sent money: Contact the bank, card issuer, or payment service immediately through a trusted number and ask about protective steps or reversal options.
Suspicious download or installation: Disconnect the affected device if an attacker may still have access, then get trusted technical help or run supported security checks from updated tools.
Google's compromised-account guide illustrates account checks, while the FTC's recovery guidance covers payments and exposed information. Change credentials from another trusted device if yours may be compromised.
For exposed identity information, U.S. readers can use IdentityTheft.gov. Report the message through the platform, alert workplace IT for work incidents, and report U.S. fraud attempts at ReportFraud.ftc.gov.
Give Yourself Permission to Check
You don't have to decide whether every alarming message is fake on sight. You can leave it unanswered while you reach the person or service another way.
That small habit works across changing stories, polished websites, and urgent callers. Your inbox can schedule as many emergencies as it likes; it doesn't get to choose how you verify them.