How to Spot Phishing Emails, Fake Messages and Online Scams
Phishing is when scammers pretend to be someone you trust, such as your bank, a delivery company, a government office or even a friend, to trick you into giving away passwords, money or personal information. It is the most common type of online fraud, and it works because the messages look convincing and create a sense of urgency.
The good news is that almost every scam shares the same warning signs. Once you know them, most phishing attempts become easy to spot.
Common types of phishing
- Email phishing: fake emails from banks, online stores, streaming services or employers.
- Smishing (SMS phishing): text messages about parcels, prizes, blocked accounts or unpaid bills.
- Messaging app scams: WhatsApp or Telegram messages from "friends" with new numbers asking for money, or requests for a verification code.
- Vishing (voice phishing): phone calls from fake bank staff or officials asking for card details or one-time codes.
- Fake websites and ads: copies of real login pages or shops advertising deals that are too good to be true.
10 warning signs of a scam
- Urgency or threats. "Your account will be blocked in 24 hours" or "Act now to claim your prize." Scammers want you to panic and act before thinking.
- Requests for sensitive information. Real banks and companies will never ask for your password, PIN, CVV or one-time code by email, SMS or phone.
- Suspicious sender addresses. The display name says "Bank Support", but the actual email address is something random or a misspelled domain.
- Look-alike links. Links pointing to addresses like
paypa1-secure-login.cominstead of the official site. - Unexpected attachments. Invoices, "documents" or ZIP files you were not expecting.
- Too good to be true. Lottery wins, free phones, unrealistic job offers or huge discounts.
- Generic greetings. "Dear Customer" instead of your name, although some scams do use your real name.
- Spelling and design errors. Poor grammar, blurry logos or odd formatting, though modern scams are getting more polished.
- Unusual payment methods. Requests to pay with gift cards, cryptocurrency or transfers to a personal account.
- Pressure to keep it secret. "Don't tell anyone" or "Don't contact the bank" is a big red flag.
How to check a link safely
On a computer, hover your mouse over a link without clicking. The real destination appears at the bottom of your browser or email app. On a phone, press and hold the link to preview the address.
Look closely at the main domain name, which is the part just before .com, .pk, .org and so on. bank.com.secure-login.net actually belongs to secure-login.net, not your bank.
The safest habit of all: do not click links in unexpected messages. Instead, open the official app or type the website address yourself.
WhatsApp and SMS scams to watch for
The "new number" friend scam
You receive a message saying, "Hi, it's me, I lost my phone, this is my new number," followed by an urgent request for money. Always call the person on their old number or ask a question only they would know before sending anything.
The verification code trick
Someone says they sent a code to your phone "by mistake" and asks you to forward it. That code is actually the key to register your WhatsApp account on their phone. Never share verification codes with anyone.
Fake parcel and prize messages
SMS messages claiming a parcel is on hold or you have won a prize, with a link to pay a small "fee". The link steals your card details.
What to do if you already clicked
Do not panic. Acting quickly limits the damage:
- If you entered a password: change it immediately on the real website, and anywhere else you used the same password. Turn on two-factor authentication.
- If you shared card or bank details: call your bank using the number on the back of your card or on its official website, and ask them to block the card.
- If you downloaded a file: disconnect from the internet and run a full antivirus scan.
- If you lost access to an account: use the service's official account recovery process right away and warn your contacts that messages from you may be fake.
- Report it: most email apps have a "Report phishing" option, and you can report scam numbers to your mobile network or local cybercrime authority.
How to protect yourself long term
- Use a password manager. It will not autofill your password on a fake site, which is a helpful warning sign.
- Turn on two-factor authentication, ideally with an authenticator app or passkey.
- Keep your phone, computer and browser updated.
- Pause before acting on any message that creates urgency or asks for money or codes.
- Teach family members, especially older relatives and children, about these warning signs.
Frequently asked questions
Can I get hacked just by opening an email?
Simply opening an email is very rarely enough on an updated device. The danger comes from clicking links, downloading attachments or entering your details.
Why do scam messages sometimes know my name?
Scammers often use personal data leaked in past data breaches. Knowing your name does not make a message genuine.
Keep reading
What Is a VPN and Do You Actually Need One?
A plain-English explanation of VPNs: what they protect, what they don't, when they're useful, and how to choose a trustworthy one.
SIM Swap Scams: How Criminals Steal Your Phone Number
Learn how SIM swap fraud works, the warning signs, and how to protect your bank and accounts that rely on SMS codes.
10 Signs Your Account Has Been Hacked (and What to Do)
Recognise the warning signs that your email, social media or other accounts are compromised, and take back control quickly.