Phishing is one of the most common ways people lose access to their accounts — and one of the easiest to stop once you know what to look for. A phishing attack is a message that pretends to be from someone you trust, such as your bank, a delivery company, or a friend, in order to trick you into handing over a password, a payment, or personal information. The message usually creates a sense of urgency: your account will be closed, a parcel is waiting, or you have won something. That urgency is the trap.

Most phishing arrives by email, but it also comes through text messages, WhatsApp, Telegram, phone calls, and social media. The channel changes; the trick stays the same. Someone you do not know wants you to click a link, open a file, or reply with information — quickly, before you have time to think.

How phishing works

A typical attack follows a simple pattern. First, the attacker picks a trusted name to imitate: a bank, a well-known shop, a government office, or a colleague. Then they send a message that looks close enough to the real thing — a copied logo, familiar colours, and a believable story. The message asks you to do one thing: click a link, download an attachment, call a number, or send a code.

The link leads to a fake login page that looks like the real one. If you type your username and password there, the attacker collects them and can sign in to your real account within minutes. Sometimes the link installs harmful software instead. Sometimes the message asks you to reply with a one-time code that was sent to your phone — that code is the key to your account, and handing it over is the same as handing over your password.

Attackers do not need to know you personally. Most phishing is sent to thousands of people at once, and even a small response rate is enough. A smaller number of attacks are targeted: the sender uses your name, your workplace, or a recent order to make the message feel personal. Those are harder to spot, which is why the habits below matter more than any single warning sign.

Warning signs to check every time

No single clue proves a message is fake, but several together should make you stop. Run through this list before you click anything.

  • Urgency and threats. "Your account will be deleted in 24 hours." "Immediate action required." Real companies rarely threaten you by email, and they never ask you to act in a panic.
  • The sender does not match. The display name says your bank, but the email address is a random string, a free mailbox, or a slightly misspelled domain. On messaging apps, check the full number or username, not just the profile photo — photos are easy to copy.
  • Generic greetings. "Dear customer" or "Dear user" instead of your name. A company you have an account with normally uses your name.
  • Links that do not match. Hover over a link (or press and hold it on a phone) to see where it really goes. If the address looks strange, has extra words, or uses a lookalike spelling of a real site, do not click it.
  • Unexpected attachments. Invoices, delivery notes, or documents you were not expecting — especially files that ask you to enable macros or run something — are a classic delivery method for harmful software.
  • Requests for passwords or codes. No legitimate company will ever ask for your password, your PIN, or a one-time code by email, text, or call. Anyone who asks is not who they claim to be.
  • Offers that are too good. A prize you never entered, a refund you never requested, or a job paying far above normal rates are all bait.
  • Sloppy language. Spelling mistakes and awkward sentences used to be a reliable sign. They are less reliable now, because attackers use the same writing tools as everyone else — but poor language is still worth noticing.

What to do when a message looks suspicious

The safest response is simple: do not click, do not reply, and do not download anything. Then verify the claim through a channel you trust. If a message says your bank account has a problem, open your banking app yourself or type the bank's web address into your browser — never use the link in the message. If a delivery company says a parcel is held, check the tracking number on the company's official site. If a friend asks for money on WhatsApp, call them on the number you already have saved, not the one in the message.

Most email apps let you report phishing with one tap. Use it. Reporting helps the provider block the same attack for other people. You can also delete the message after reporting it. On WhatsApp and Telegram, report the message as spam and block the sender.

If you already clicked or replied

Mistakes happen, and acting fast limits the damage. If you entered a password on a suspicious page, change that password immediately — from the real site, not from any link in the message. If you use the same password anywhere else, change it there too. Turn on two-factor authentication on the account if you have not already; it can block an attacker even when they have your password.

If you shared a payment card number, contact your bank and ask them to block the card. If you sent money, tell your bank straight away and keep every detail of the message as evidence. If you downloaded a file, run a scan with your device's built-in security or a trusted antivirus program, and do not open the file again.

Finally, tell the people around you. If your email account was used to send phishing to your contacts, warn them. There is no shame in being targeted — these attacks are designed by professionals and sent to millions of people.

Simple habits that stop most phishing

You do not need to become a security expert. A few habits cover most attacks. Use a different password for every important account, and keep them in a password manager instead of reusing one password everywhere. Turn on two-factor authentication on your email, your bank, and your social accounts — your email matters most, because it can reset almost everything else.

Keep your phone and computer updated, because updates close the holes that harmful software uses. Be careful with links in messages even from people you know, because their accounts can be hacked and used to spread phishing to their contacts. And slow down whenever a message pushes you to act now. Urgency is the attacker's favourite tool; a few seconds of checking is usually all it takes to see through it.

Phishing works because it targets human habits, not computer systems. Once you know the pattern — a trusted name, a believable story, and pressure to act quickly — you will start noticing it everywhere, and most attacks will stop at your inbox instead of reaching your accounts.