You get a text message saying your bank account has been locked and you must click a link immediately. Or an email that looks exactly like it came from your delivery company, asking you to confirm your address. These are examples of phishing, and they are among the most common online scams in the world. So what is phishing, exactly? It is a trick where criminals pretend to be someone you trust — a bank, a company, or even a friend — to steal your passwords, money, or personal information. This guide explains how phishing works, how to spot it, and what to do if it happens to you.
Phishing works because it targets people, not computers. The messages are designed to create panic or excitement so you act before you think. The good news is that once you know the warning signs, most phishing attempts are easy to recognize. A few simple habits can protect you almost completely.
Important safety note: no real bank, company, or government office will ever ask you to share your password or one-time code (OTP) by email, text message, or phone call. Never share your passwords or OTP codes with anyone, no matter how urgent the message sounds or who it claims to be from. Anyone asking for them is a scammer.
What Is Phishing? A Simple Definition
Phishing is a type of online fraud where attackers impersonate trusted organizations or people to trick you into giving up sensitive information. The name comes from “fishing” — the scammer casts a wide net of fake messages, hoping someone will bite.
A typical phishing attack starts with a message that looks legitimate. It might warn you about a problem with your account, offer you a prize, or ask you to verify your identity. The message contains a link to a fake website that looks like the real one, or an attachment that installs harmful software. If you enter your login details on the fake site, the criminals capture them and can then access your real accounts.
Phishing is not a rare or highly technical crime. It is mass-produced and sent to millions of people at once. Even careful people can be caught off guard when a message arrives at a stressful moment, which is why understanding the patterns matters more than any single technical defense.
Common Types of Phishing Attacks
Phishing comes in several forms. Knowing the names helps you recognize them wherever they appear.
Email Phishing
The classic form. You receive an email that appears to come from your bank, an online store, a delivery service, or a government agency. It urges you to click a link or open an attachment. The link leads to a fake login page designed to steal your credentials. These emails often use the company’s real logo and layout, copied from the genuine site.
Smishing (SMS Phishing)
Phishing by text message. Common examples include fake parcel delivery notifications, bank security alerts, and messages claiming you have won something. Because text messages feel personal and urgent, people tend to click links in them quickly. Be especially suspicious of texts from unknown numbers that contain links.
Vishing (Voice Phishing)
Phishing by phone call. A scammer calls pretending to be from your bank’s fraud department, a tech support team, or the police. They may already know your name and some details about you, which makes them sound convincing. Their goal is to get you to reveal passwords, card numbers, or OTP codes over the phone — or to install remote-access software on your computer.
Spear Phishing and Whaling
Most phishing is generic, but spear phishing targets a specific person with personalized details, such as their job title or colleagues’ names. Whaling targets senior executives and important figures. These attacks are rarer but more convincing, because the message is crafted just for you.
QR Code and Social Media Phishing
Newer tricks include fake QR codes on posters or in emails that lead to scam sites, and phishing through social media direct messages. A hacked friend’s account might send you a message with a malicious link, so even messages from people you know deserve a second look if they seem out of character.
Warning Signs: How to Spot a Phishing Message
Phishing messages share recognizable patterns. Check for these red flags before you click anything.
Urgent or Threatening Language
“Your account will be closed in 24 hours!” “Suspicious activity detected — verify now!” Scammers create panic so you act without thinking. Real companies rarely demand immediate action by message, and they never threaten you this way.
Suspicious Sender Addresses and Links
Look closely at the sender’s email address, not just the display name. A message claiming to be from your bank but sent from a random Gmail address is fake. Before clicking a link, hover over it (or press and hold on a phone) to see the real web address. If it does not match the company’s official website, do not click.
Requests for Passwords, OTP Codes, or Card Details
This is the biggest red flag of all. Legitimate companies will never ask for your password, PIN, or one-time code by email, text, or phone. If a message asks for any of these, it is phishing — delete it. Remember: never share your passwords or OTP codes with anyone, for any reason.
Poor Spelling, Strange Greetings, and Unexpected Attachments
Many phishing messages contain spelling mistakes, odd grammar, or generic greetings like “Dear Customer” instead of your name. Unexpected attachments — especially invoices, receipts, or documents you did not ask for — are also suspicious. Do not open them.
Too Good to Be True
You have won a lottery you never entered. A stranger wants to send you money. A famous brand is giving away free phones to the first 100 people. If an offer seems unbelievably generous, it is bait.
Real-Life Phishing Examples to Watch For
Seeing concrete examples makes the warning signs easier to remember. One of the most common scams is the fake delivery text: “Your parcel is held at the depot. Pay a small fee to release it: [link].” The link leads to a fake payment page that steals your card details. Delivery companies never ask for fees by text message.
Another frequent one is the bank security call. Someone claiming to be from your bank’s fraud team says there has been suspicious activity and asks you to read out the OTP code you just received. In reality, the scammer triggered that code by trying to log in as you — and your code is the final key they need. A real bank will never ask for it.
Workplace scams are rising too. An email that looks like it comes from your boss asks you to urgently buy gift cards or transfer money. The email address is usually one letter off from the real one. If a request involving money arrives unexpectedly, always verify through a different channel — call the person or walk over to their desk before acting.
What to Do If You Receive a Phishing Message
If you spot a phishing attempt, do not click any links, do not reply, and do not open attachments. On your phone, you can report the message as spam or junk, which helps protect others. In your email app, use the “Report phishing” option if one is available.
If the message pretends to be from a company you actually use, contact that company directly through their official website or app — never through the links in the suspicious message. Type the web address yourself or use the app you already have installed. This simple habit defeats almost every phishing attempt.
You can also take a screenshot of the suspicious message before deleting it, so you have evidence if you need to report it. If you are on Windows and not sure how, our guide on how to screenshot on Windows walks through five easy methods.
What to Do If You Already Clicked or Shared Information
Do not panic — quick action can limit the damage. If you entered a password on a fake site, change that password immediately on the real website, and change it anywhere else you used the same password. Turn on two-factor authentication for extra protection.
If you shared bank or card details, call your bank right away using the number on your card or their official app. Banks deal with this every day and can freeze or replace compromised cards. If you shared an OTP code, contact the relevant service immediately, since OTPs give attackers direct access.
Run a security scan on your device if you opened an attachment or downloaded anything. Then watch your accounts closely for unusual activity over the next few weeks. Consider placing a fraud alert with your bank if financial details were involved.
How to Protect Yourself from Phishing
Prevention is mostly about habits, not technology. Be skeptical of unexpected messages that ask you to act quickly, especially ones with links or attachments. Always reach companies through their official apps or websites rather than through message links. Keep your phone and computer updated, since updates fix security holes that attackers exploit.
Use a password manager so you do not need to remember or reuse passwords, and turn on two-factor authentication wherever it is offered. These two steps mean that even if a scammer gets one password, they still cannot get into your accounts easily. A firewall and antivirus software add another layer of defense on your devices, blocking some malicious sites and downloads — though no software can stop a scam that tricks you into handing over information yourself.
Finally, talk about phishing with family members who may be less familiar with technology. Older relatives are common targets, and a short conversation about the warning signs can save them from real financial harm.
FAQs About Phishing
What is phishing in simple words?
Phishing is when criminals send fake emails, texts, or calls pretending to be a trusted company or person, trying to trick you into sharing passwords, OTP codes, or money. Think of it as digital impersonation for the purpose of theft.
Can phishing happen on my phone?
Yes, phones are actually the most common target now. Fake text messages about deliveries, bank alerts, and prizes arrive on phones every day. Be just as careful with links in texts as you are with links in emails — maybe more so, since phone screens show less information about where a link really goes.
How do I know if a link is safe?
Hover over the link on a computer, or press and hold it on a phone, to preview the real web address before clicking. Check that the domain matches the company’s official website exactly — scammers use lookalike addresses with extra words, misspellings, or unusual endings. When in doubt, go to the company’s site directly instead of clicking.
What happens if I click a phishing link but enter nothing?
Just clicking is usually less dangerous than entering information, but it is not risk-free. Some links can trigger automatic downloads of harmful software. If you clicked, do not enter anything, close the page, run a security scan, and clear your browser data. Our guide on how to delete cookies shows how to remove traces left behind in your browser.
Should I reply to phishing messages to waste the scammer’s time?
It is better not to reply at all. Replying confirms your number or email address is active, which can lead to more scam attempts. Simply report the message as spam or phishing and delete it.
Can antivirus software stop phishing?
Antivirus and firewalls can block some malicious websites and attachments, but they cannot stop every phishing attack — especially ones that rely on tricking you rather than infecting your device. Your own awareness is the most important protection. Technology helps, but recognizing the warning signs matters more.
Conclusion
Phishing is one of the most widespread online threats, but it is also one of the easiest to defeat once you know what to look for. Remember the core warning signs: urgent or threatening language, suspicious sender addresses, requests for passwords or OTP codes, and offers that seem too good to be true. Never share your passwords or one-time codes with anyone, no matter who the message claims to be from.
Key takeaways: treat unexpected messages with links as guilty until proven innocent, contact companies through their official apps and websites, turn on two-factor authentication, and act fast if you ever slip up — change passwords and call your bank. Stay skeptical, stay calm, and scammers will move on to easier targets.
