Overview
This guide is for anyone who wants to stay safe online by learning how to recognise phishing messages. Phishing is a cyberattack in which criminals impersonate trusted people or organisations to trick you into sharing sensitive information, clicking malicious links, downloading harmful files, or sending money.
Phishing messages can arrive through emails, text messages, social media, and other communication platforms. Knowing what to look for can help you avoid becoming a victim.
Steps
Step 1: Check the sender
Look carefully at the sender's email address, phone number, or account profile. Attackers often use addresses that look similar to legitimate ones but contain small spelling changes or unfamiliar domains.
Example: An email claims to come from your bank, but the sender's address does not match the bank's official domain.
What you should see: You should be able to identify whether the sender's details look familiar and match a trusted source. Remember that sender names can be spoofed.
Step 2: Look for urgent or threatening language
Phishing messages often pressure you to act quickly. They may threaten to suspend your account, claim that a payment has failed, or promise a reward that expires soon.
Example: "Your account will be blocked in 24 hours. Click here to restore access immediately."
What you should see: You should recognise language designed to create panic or push you into acting without checking whether the message is genuine.
Step 3: Inspect suspicious links
Phishing messages often pressure you to act quickly. They may threaten to suspend your account, claim that a payment has failed, or promise a reward that expires soon.
Example: "Your account will be blocked in 24 hours. Click here to restore access immediately."
What you should see: You should recognise language designed to create panic or push you into acting without checking whether the message is genuine.
Step 4: Watch out for requests for sensitive information
Be cautious of unexpected messages asking for your password, banking details, one-time password (OTP), or multi-factor authentication (MFA) code.
Legitimate organisations should not ask you to disclose your password or verification codes through suspicious messages.
What you should see: You should be able to recognise requests that could expose your accounts or financial information.
Step 5: Check unexpected attachments
Phishing emails may contain attachments disguised as invoices, receipts, delivery notices, or important documents. These files may contain malware.
Do not open unexpected attachments until you have verified the sender and confirmed that the file is legitimate.
What you should see: You should know to treat unexpected attachments with caution, even when the message appears professional.
Step 6: Verify the message independently
If a message claims to come from your employer, bank, or a service provider, confirm the request through a separate trusted channel.
Use a phone number you already know or visit the official website directly. Do not rely on contact details supplied in the suspicious message.
What you should see: You should be able to verify a request without interacting with a potentially malicious message.
summary
Phishing messages can look convincing, even when they appear to come from someone you trust. Always check the sender, examine links carefully, question urgent requests, and verify information independently before taking action.
Remember: Pause. Check. Verify. Report.