Phishing is a message that pretends to come from someone you trust so that you will click a link, open an attachment or hand over a password or payment details. It arrives by email, text message, social media or phone, and it is one of the most common ways accounts get taken over.
This Webinkey.com guide explains the signs that give phishing away, how to check a link without falling for it, and what to do if you have already clicked.
Key Takeaways
- Phishing tells a story, such as a locked account or a failed payment, to rush you into clicking.
- Check the sender address and preview links before you click, or skip the link and type the address yourself.
- Multi-factor authentication and passkeys make stolen passwords far less useful.
- Forward phishing emails to reportphishing@apwg.org and scam texts to 7726.
What a Phishing Message Usually Wants
The Federal Trade Commission notes that phishing messages often tell a story to get you to act: they claim there is a problem with your account or payment, say they noticed suspicious activity, ask you to confirm personal information, include a fake invoice, or promise a refund or a prize. The goal is always the same: get you onto a page the scammer controls, or get you to send information directly.
Warning Signs in the Message
- Urgency or fear. “Your account will be closed today” is designed to stop you thinking.
- A sender address that does not match. The display name says a bank or delivery company, but the actual address uses a different or misspelled domain.
- A generic greeting. “Dear customer” from a company that normally uses your name.
- Requests for passwords, codes or card numbers. Legitimate companies do not ask you to send these by email or text.
- Unexpected attachments. Especially invoices, documents that ask you to “enable content”, or compressed files.
- Links that do not match the text. The link says one company but points somewhere else.
How to Check a Link Safely
On a computer, hover over a link without clicking and read the address that appears at the bottom of the browser or mail app. On a phone, press and hold the link to preview it. Read the domain from right to left: in account-update.example.com.verify-login.net, the real domain is verify-login.net, not example.com.
The safest habit is not to use the link at all. Open a new tab, type the company’s address yourself or use its official app, and sign in from there. If there really is a problem with your account, you will see it.
How to Recognize a Fake Login Page
Phishing links usually lead to a copy of a real sign-in page. It may look identical, so check the address bar rather than the design. Watch for lookalike spellings, extra words in the domain, and pages that ask for more than a normal login would, such as your card number or security answers. Our guide on how to check if a website is legit covers more ways to test an unfamiliar site.
Protect Your Accounts Before It Happens
The Cybersecurity and Infrastructure Security Agency (CISA) recommends turning on multi-factor authentication, because a stolen password alone is then not enough to get into your account. Phishing-resistant options such as passkeys and security keys are stronger than codes sent by text message. A password manager also helps: it will not offer to fill your password on a lookalike domain, which is a useful warning in itself. See our password manager basics for how that works.
What to Do If You Clicked
- Do not enter anything else. Close the page.
- If you typed a password, change it right away on the real site, and on any other account that used the same password.
- If you shared card or bank details, call your bank or card issuer using the number on your card.
- If you opened an attachment, run a security scan and keep your device updated.
- If personal information was taken, use IdentityTheft.gov for a recovery plan.
How to Report Phishing in the U.S.
The FTC suggests forwarding phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forwarding scam text messages to 7726 (SPAM), and reporting the attempt at ReportFraud.ftc.gov. You can also use the “report phishing” option in your email app, which helps the provider filter similar messages.
For more everyday safety guides, browse the Online Safety section or return to the main Webinkey.com guide.
Common Phishing Scenarios
Scammers follow the news and the calendar, so the same few stories appear again and again.
Delivery Problems
A text says a parcel could not be delivered and asks you to pay a small redelivery fee or confirm your address. Delivery companies do send tracking messages, so check the status on the carrier’s own website or app using the tracking number from your original order.
Account or Payment Alerts
An email claims your streaming, shopping or bank account is locked or that a payment failed. Sign in through the official app or a typed address instead of the link. If nothing is wrong there, the message was fake.
Refunds, Prizes and Tax Messages
Messages promising a refund, a prize or money from a government agency are designed to collect bank details. In the U.S., the IRS says it does not start contact with taxpayers by email, text message or social media to request personal or financial information.
Messages From a “boss” or Friend
A message that appears to come from someone you know asks for gift cards or an urgent payment. Contact the person through a number or channel you already have before doing anything.
Teach the Habit to Others
Phishing works because it targets everyone, including children and older relatives. Share one simple rule with family members: never act on a link or attachment in an unexpected message; open the app or type the address instead. That one habit blocks most phishing attempts, whatever story the message tells.
It also helps to keep your email provider’s spam filter switched on and to mark suspicious messages as phishing rather than simply deleting them. Each report helps the filter recognise similar messages for you and for other users.
At a Glance
| Warning sign | Example | What to do |
|---|---|---|
| Urgency | “Your account will be closed today” | Pause and check in the official app |
| Mismatched sender | A bank name with an unrelated domain | Read the full address, not the display name |
| Request for codes | A text asking for a sign-in code | Never share it; companies do not ask |
| Unexpected attachment | An invoice you did not order | Do not open it; report the message |
Keep reading on Webinkey.com: Tech.
Frequently Asked Questions
Can I Get Hacked Just by Opening a Phishing Email?
Opening a message is generally low risk on an up-to-date device. The danger comes from clicking links, opening attachments, or replying with information. Keep your device and email app updated, and treat any link or attachment inside the message with caution.
Are Phishing Texts Different From Phishing Emails?
The method differs, but the tricks are the same: urgency, a fake problem and a link. Text phishing is often called smishing. Forward scam texts to 7726. The safest reply is none at all: open the official app or website yourself and check whether anything is really wrong.
Does Multi-Factor Authentication Stop Phishing?
It makes stolen passwords far less useful. Passkeys and security keys are the most phishing-resistant options because they only work on the real website. Turn it on first for your email account, because access to your inbox can be used to reset most of your other passwords.
Should I Reply to Tell the Scammer I Know?
No. Replying confirms that your address is active. Report the message and delete it. Use the report option in your email app or forward the message to reportphishing@apwg.org, then delete it. Replying, even to complain, shows that your address is active and can lead to more scam messages.
