Phishing works because it targets people, not machines. A message that looks like it comes from your bank, your boss or a delivery company creates urgency, and a rushed click is all an attacker needs. Verizon's 2026 Data Breach Investigations Report continues to list social engineering and stolen credentials among the most frequent causes of breaches.
This guide teaches you to recognise the signs, shows typical examples and explains what to do if you have already clicked.
Key takeaways
- Slow down: urgency is the attacker's main tool.
- Check the real sender address and the real link destination.
- Never log in through a link in an unexpected message; open the site yourself.
- Turn on multi-factor authentication, ideally passkeys, on important accounts.
12 warning signs
- Urgency or threats. "Your account will be closed in 24 hours." Real organisations give reasonable time.
- The sender address does not match. The display name says "Bank" but the address is something like support@secure-bank-help.example.
- Look-alike domains. A letter swapped for a similar one, such as rn instead of m, or an extra word added.
- Generic greeting. "Dear customer" when the company normally uses your name.
- Unexpected attachments such as invoices, voicemail or "documents to review", especially zip and macro-enabled files.
- Links that go somewhere else. Hover (or long-press on a phone) to see the real address.
- Requests for passwords, codes or card numbers. Legitimate companies do not ask for these by email or chat.
- Requests to change bank details for a supplier or an employee, especially "from the boss" on a new address.
- Too good to be true. Prizes, refunds, easy jobs or large inheritances.
- Strange wording or formatting. Not every scam has typos: AI tools now produce flawless text, so never use grammar as your only test.
- Pressure to keep it secret or to bypass normal procedure.
- An unexpected login or verification code. If you did not request it, someone may be trying to get in; do not share it.
Common phishing examples
| Scam | How it looks | What is really happening |
|---|---|---|
| Account suspended | "Your account has been locked. Verify now." with a button | The link opens a fake login page that steals your password |
| Delivery problem | "Your parcel could not be delivered. Pay a small fee." | A fake payment page captures card details |
| Fake invoice | "Invoice attached" from an unknown supplier | Malware or a link to a credential-harvesting page |
| CEO fraud | "I am in a meeting. Buy gift cards quietly." | An attacker impersonating a manager to move money |
| Password-reset trick | "A password reset was requested." | A fake alert that leads to a fake login, or a real alert that means someone is trying your account |
| Job offer | "Easy remote job, send your documents and a deposit." | Identity theft or advance-fee fraud |
| QR code scam ("quishing") | A QR code in an email or on a sticker | It leads to a phishing page; verify the destination before entering anything |
Because QR codes can hide the real address, always check where a scanned code goes before logging in; see how legitimate codes are made in our WiFi QR code guide.
Smishing, vishing and chat scams
- SMS and WhatsApp: "Hi, is this your photo?" or "Your account is blocked" with a link. Do not click; check with the organisation directly.
- Phone calls: callers claiming to be a bank or police and asking for OTP codes. Hang up and call the official number yourself.
- Social media: accounts of friends that were hacked asking for money or votes.
- Fake support: pop-ups telling you to call a "helpline". Close the window.
A 10-second check before you click
- Expected? Was I waiting for this message?
- Sender: is the full address exactly right?
- Link: does the hover address match the claimed company?
- Ask: does it ask for money, codes, passwords or secrecy?
- Verify: if in doubt, contact the sender through a number or website you already know, not the one in the message.
What to do if you clicked or typed something
- Disconnect from the network if you downloaded a file or suspect malware.
- Change the password of the account (and anywhere you reused it) from a different, clean device.
- Turn on or reset multi-factor authentication and sign out other sessions.
- Contact your bank if you shared card or banking details.
- Tell your IT team or provider immediately. Speed limits the damage.
- Run a security scan and check email forwarding rules and recovery settings.
- Report the message to your email provider and the impersonated company.
Protect yourself
- Use a password manager: it will not auto-fill on fake sites, which is a useful alarm. See our password guide.
- Enable multi-factor authentication and prefer passkeys or security keys: see the 2FA guide.
- Keep devices and browsers updated.
- Be careful with attachments, even PDFs; see safe PDF handling.
- Use official apps and bookmarks for banks and key services.
For businesses: reduce the risk
- Email authentication: SPF, DKIM and DMARC to prevent spoofing of your domain.
- Filtering and link protection.
- A culture where staff report suspicious messages quickly without blame.
- Payment verification: call back on a known number before changing bank details.
- Short, regular training and simulations.
Read the full list in 7 cybersecurity threats every small business faces, or get help from our cybersecurity team. Contact us for a free security checkup.
