Notice the action being requested
Phishing is an attempt to steer you into revealing information or performing an unsafe action by impersonating a trusted person or organization. It can arrive through email, a text message, a phone call, a social platform or a QR code. The useful question is not simply whether the message looks professional. Ask what it wants you to do and what could happen if you comply.
Pressure is a common clue. A message may claim that a delivery will be cancelled, a manager needs an urgent transfer or an account will disappear unless you act now. Some attacks take the opposite approach and build a friendly conversation over time. Good grammar, a familiar logo and accurate personal details do not establish that the sender is genuine.
Move the check to a separate channel
If a message claims to come from your bank, open the bank’s official app or use a number from your card or a previous trusted statement. Do not use the telephone number included in the suspicious message. If a colleague requests a payment change, call through a known directory entry or a previously established number. A reply within the same compromised conversation may reach the attacker.
For an unexpected account warning, navigate to the service independently and look for the same alert. You do not need to determine every detail of the deception before refusing to act through its link. If you cannot verify the request, pause it. Genuine urgency does not remove the need to confirm where money, credentials or sensitive documents are going.
Inspect addresses without trusting appearances
A display name can say almost anything. Expand the sender details when your mail application allows it, but remember that even a genuine account may be compromised. Look carefully at the actual destination of a link. A long address can contain a recognizable brand in a misleading place. If the domain structure is unclear, use your known bookmark instead of trying to solve it under pressure.
HTTPS means the connection to that destination is encrypted; it does not certify the honesty of the business or page. Search results and advertisements can also lead to imitation sites. On a phone, inspecting a link may be awkward, and some gestures can accidentally open it. There is no need to preview a questionable link if opening the known service separately answers your question.
Be careful with attachments and QR codes
An attachment can be a document that asks you to enable risky content, an executable file or a link disguised as a shared document. Do not bypass security warnings just because the sender says the file is important. Confirm unexpected files with the sender independently, particularly when the message involves invoices, payroll, identification or a change in banking details.
A QR code is another way to deliver a destination. An attacker can replace a printed code or include one in a convincing email. Before signing in or paying, check that you reached the service you intended. Avoid installing applications from a QR destination unless you have independently confirmed the source and purpose. Use your device’s official application store when appropriate, while still checking the publisher.
Match your response to what happened
If you only received the message, use your mail or messaging application’s report function, then delete it. If you opened a link but entered nothing, close it, avoid downloads and check for unexpected browser permissions or installed items. Keep the browser and device updated. A click alone does not prove compromise, but neither should you ignore subsequent warnings or unusual behavior.
If you entered a password, use a trusted device to visit the real service, change that password and review sessions, recovery methods and forwarding rules. Change it anywhere else you reused it. If you approved an unfamiliar authentication prompt, treat that as possible account access, not merely a strange notification. Follow the provider’s compromised-account process and your workplace’s reporting process if applicable.
If you transferred money or shared financial details, contact the relevant financial institution promptly through an established channel. Explain exactly what happened without assuming a payment can be recovered. Preserve useful evidence such as the message, timestamps and transaction references, but do not continue communicating with the suspect sender. Be wary of anyone promising guaranteed recovery for a fee.
Build a routine that survives distraction
Agree on a family or workplace rule for unusual payment requests: verify by a known channel before acting. Keep software current, use stronger authentication and avoid granting remote access to unexpected callers. These measures reduce different risks; none replaces independent verification. For further reading, see the Federal Trade Commission’s phishing guidance, CISA’s reporting advice and the UK National Cyber Security Centre’s phishing resources.