Phishing is an attempt to trick you into handing over sensitive information — passwords, card details, one-time codes — by pretending to be a trusted organisation such as your bank, a delivery company, or a well-known service. The messages have become more convincing over time, but they tend to share a set of recognisable patterns once you know what to look for.
Common red flags
A sense of urgency is one of the most reliable signals: messages claiming your account will be suspended, a payment has failed, or you must act "immediately" are designed to make you react before you think. Other signs include being asked to confirm login details or payment information out of the blue, a generic greeting instead of your name, links that don't quite match the organisation's real website when you hover over them, and offers or refunds that seem unusually generous for no clear reason.
Where phishing attempts show up
While email is the classic format, the same tactic appears by text message (often called smishing), phone calls (vishing), and fake websites that closely copy a real login page. Increasingly, scammers also use direct messages on social media or messaging apps, sometimes impersonating someone you know whose account has been compromised.
- Don't click links or call numbers provided in an unexpected message — go to the organisation's official app or website directly instead.
- Check the sender's actual email address or number, not just the display name.
- Be suspicious of any request to "verify" your account urgently, especially involving a password or one-time code.
- If in doubt, contact the organisation through a channel you already know is genuine.
What to do if you suspect one
If you think you've received a phishing attempt, avoid clicking anything and report it through your email provider, bank, or the relevant organisation's official reporting channel. If you've already clicked a link or entered details, change the affected password promptly and keep an eye on the account for unusual activity. Staying a little sceptical of unexpected, urgent requests is the single most effective habit against phishing.
