Phishing: How Scam Messages Work and How to Spot Them

What phishing is

Phishing is an attempt to trick you into giving away something valuable, such as a password, bank details or a payment, by pretending to be someone you trust. The name is a play on “fishing”: the sender casts out bait and waits for someone to bite. It is one of the most common ways accounts get taken over, partly because it targets people rather than technology.

Phishing arrives through several channels:

• Email, the classic route.
• Text messages, sometimes called smishing.
• Phone calls, sometimes called vishing, including automated voice messages.
• Social media and messaging apps, often from a hacked account of someone you know.
• QR codes placed on posters, parking signs or letters that lead to a fake page.

How the trick usually works

Most phishing follows a similar shape.

1. A believable sender. The message appears to come from a bank, delivery company, government office, employer, online store or a friend.
2. A reason to act. Something is wrong or exciting: a suspicious payment, a locked account, an unpaid bill, a missed delivery, a refund, a prize.
3. Pressure. There is a deadline or a threat, such as “act within 24 hours or your account will close”.
4. A request. You are asked to click a link, open an attachment, call a number, reply with information or install something.
5. The payoff for the scammer. A fake login page records what you type, an attachment installs harmful software, or the scammer persuades you to send money.

Creating urgency is the central psychological lever. People who feel rushed or frightened skip the checks they would otherwise make.

Common varieties

• Account alerts. “We noticed unusual activity. Verify your account.” The link leads to a copy of a real login page.
• Delivery and payment notices. A small fee is requested to release a package.
• Invoice or payment scams. A fake bill, or a message that appears to come from a colleague or supplier asking for a changed bank account. Business versions often target people who handle payments.
• Impersonating a relative or friend. A message claims to be from someone you know with a new number, asking for money urgently.
• Spear phishing. A message tailored to one person using details from social media or a previous leak, which makes it seem much more credible.
• Job and romance scams. These build trust over days or weeks before asking for money or information.
• Tech-support scams. A pop-up or call claims your computer is infected and asks for remote access or payment.

Writing quality is no longer a dependable clue. Modern tools can produce fluent text in any language, and generative AI may make tailored messages easier to produce at scale, so a polished message is not proof of legitimacy.

Warning signs

No single sign is conclusive, but a combination should make you cautious.

• Unexpected contact about something you did not initiate.
• Urgency or threats, or an offer that seems too good to be true.
• A sender address that is slightly off, such as an extra character or an unfamiliar domain. The display name can say anything, so check the actual address.
• Links that do not match. On a computer, hovering over a link usually shows its real destination. Lookalike addresses may swap letters or add words.
• Requests for sensitive information such as passwords, full card numbers, one-time codes or identity details. Legitimate organizations usually do not ask for a password by email or text.
• Requests for unusual payment methods, such as gift cards, cryptocurrency or wire transfers.
• Generic greetings like “Dear customer”, though some scams use your name.
• Unexpected attachments, especially compressed files or documents that ask you to enable macros or editing.
• Requests for secrecy. “Don’t tell anyone” is a common scam tactic.

What to do instead of clicking

1. Pause. A few minutes of delay rarely cost anything real.
2. Go to the source yourself. Open the official website by typing the address or using a bookmark, or use the company’s app. Call a phone number from your card or an official statement, not one from the message.
3. Contact the person another way. If a friend or relative asks for money, call them on a number you already have.
4. Verify payment changes. In a workplace, confirm requests to change bank details through a separate channel.
5. Never share one-time codes. If anyone asks you to read out a code that was just texted to you, it is a common sign of fraud.
6. Keep software updated and consider the spam filters provided by your email service.
7. Use extra verification on accounts. Even if a password is stolen, two-factor authentication makes it harder to use. Password managers can also help because they typically will not auto-fill a login on a fake site.

If you already clicked or replied

Mistakes happen to careful people. General steps include:

• If you entered a password, change it right away on the real site, and anywhere else you used it.
• If you shared payment details, contact your bank or card provider promptly, using the number on the card.
• If you opened a suspicious file, disconnect from the network if you can, run a security scan and seek help from a trusted technical source.
• Report the message to the organization being impersonated, to your email provider, and to a consumer-protection or fraud-reporting service in your country.
• Watch your accounts for unusual activity for a while.
• Be aware that victims are sometimes contacted again by “recovery” scammers who offer to get money back for a fee.

A habit worth building

The strongest defense is a standing rule: do not act on an unexpected message that asks for something; check it independently first. It costs little and defeats most phishing, because every version relies on getting you to act before you think. For wider context, see cybersecurity basics, and for what happens to data once it is exposed, see online privacy.