What Is Phishing and How Do You Avoid It?

TL;DR

• Phishing is a message, usually an email or text, that pretends to come from a trusted source to trick you into giving up passwords, money or personal details [1][2].
• Warning signs include urgent or threatening wording, requests for personal information, and addresses or links that are slightly wrong.
• Do not use the link in the message. Go to the real site yourself or call a number you already trust.
• If you clicked, act quickly: do not enter anything, update and scan your device, and contact the affected company.

Common warning signs #

Phishers want you to act before you think. CISA lists these signs [1]:

• Urgent or emotional language, especially threats if you do not respond right away.
• Requests for personal or financial information.
• Shortened or unfamiliar links.
• Sender addresses or web addresses that are slightly off, such as a swapped letter in a company name.

Poor spelling used to be a giveaway, but AI tools can now write polished messages, so do not rely on it [1]. A logo, a generic greeting or a professional design also prove nothing [2]. The FTC adds typical bait: an unexpected bill, a claim of suspicious account activity, a refund, or a request to confirm payment details [2].

Think of it as a stranger at the door claiming to be from your bank: you would check their story using a number you already know, not one they hand you.

How to protect yourself #

1. Pause and ask: "Do I have an account with this company, or know this person?" If not, treat it as phishing [2].
2. Verify another way: type the website address yourself or call a number you know is real, not the contact details in the message [1][2].
3. Do not engage: do not reply, open odd attachments or use "unsubscribe" links in suspicious messages [1].
4. Use two-factor authentication so a stolen password alone is not enough, and use a password manager and install updates promptly [1][2].
5. Report and delete: use your email's report option. In the US, forward phishing emails to [email protected] and texts to 7726 (SPAM) [2].

Workplaces often have their own reporting button. The UK NCSC stresses that people should feel safe reporting even when they have already clicked, because speed helps the response [3].

What to do if you clicked #

Do not panic, and do not blame yourself. Based on the FTC and NCSC guidance [2][3]:

• Stop: do not enter or approve anything the page or message asks for.
• If you may have installed something: update your security software, run a full scan and remove what it finds [2][4].
• If you gave a password: change it on the real site and anywhere you reused it, and turn on two-factor authentication.
• If you gave financial or ID details: contact your bank or card company, and in the US see IdentityTheft.gov for steps matched to what you shared [2].
• Report it: tell your workplace IT team if it involves work, and report to the FTC at ReportFraud.ftc.gov in the US [2][3].

FAQ #

What is the difference between phishing, smishing and vishing? #

They are the same trick on different channels. Phishing usually means email, smishing is by text message and vishing is by phone call. The advice is the same: verify through a channel you trust.

Can I get infected just by opening a phishing email? #

The larger risk is clicking a link or opening an attachment. Opening a message is less risky, but do not click or download from one you do not trust [2][4].

Does the padlock mean a site is safe? #

No. A padlock means the connection is encrypted, not that the site is honest, so check the address itself.

Sources #