How to Spot a Phishing Message Before Clicking Any Link

Phishing is when criminals send a message that looks like it comes from a bank, a delivery company, an online shop or even your employer, hoping you will click a link, share a password or send money. The messages can arrive by email, text, phone call or social media, and they are often written to look urgent.

Urgency and fear are the classic warning signs. Messages that say your account will be closed, a package is held or a payment failed, and that you must act right now, are a common trick. Be careful too if someone asks for a password, a one-time code, a card number or gift cards, because real companies do not ask for these by message.

Check the sender and the links. Small changes in an address, such as a swapped letter or an extra word, can hide a fake. On a computer, hover over a link to see where it really goes, and on a phone, press and hold it. If the address does not match the company, do not open it. Generic greetings like "Dear customer" and spelling errors can also be a sign, though some scams are well written.

Instead of clicking, open the company's official app or type its web address yourself, then check your account. If you are unsure, call the number printed on your card or on the official website, not the number in the message.

To protect your accounts, use a different password for each one and keep them in a password manager. Turn on two-factor authentication wherever it is offered, and keep your phone and computer updated, since updates close security holes.

If you already clicked, change the password on that account and on any other account where you used it. Contact your bank if you shared card details, and report the message to the company it pretended to be and to your local cybercrime authority.

Source: General consumer cybersecurity guidance.