The short version
Phishing is a message pretending to be someone you trust so you'll click a link, open a file, send money or hand over a password. The biggest giveaway is pressure. When a message rushes you, slow down and check it a different way.
What it is
Phishing (pronounced "fishing") is when a scammer sends bait and waits for someone to bite. The message looks like it's from your bank, a delivery company, Microsoft, a coworker or even your boss. The goal is to get you to:
- type your password into a fake login page,
- open an attachment that installs malware,
- pay a fake invoice, send gift cards, or change someone's bank details.
It comes in a few flavors: by text it's called smishing, by phone it's "vishing," and when it's carefully tailored to one person it's "spear phishing."
The warning signs
- Urgency or fear: "Your account will be closed today," "Payment failed," "I need this done in the next hour."
- A sender that's almost right: look at the actual email address, not just the name.
support@micros0ft-help.comis not Microsoft. - Links that don't go where they say: on a computer, hover over a link to preview the real address. On a phone, press and hold.
- Unusual requests: gift cards, wire transfers, "updated" bank details, or a password reset you didn't ask for.
- Unexpected attachments, especially "invoices," "voicemails" or shared documents you weren't expecting.
- Something just feels off: odd greeting, a strange tone for that person, or a request out of the blue.
Good habit: never use the link or phone number in the message to check it. Open the app yourself, type the website address yourself, or call a number you already know.
What to do with a suspicious message
- Don't click, reply or open attachments.
- Verify another way. Call the person or company using a number you already have.
- Report it. In Outlook and Gmail, use the built-in "Report" or "Report phishing" option. In the US you can forward scam texts to 7726 (spells "SPAM") for most carriers, and report fraud to the FTC at reportfraud.ftc.gov.
- Delete it.
"I already clicked." Now what?
Don't panic, and don't hide it. Acting quickly matters more than anything else.
- If you entered a password, change it right away (and anywhere else you used the same one).
- Turn on two-factor authentication if it isn't already on.
- If it was a work account, tell your IT person or provider now. They'd much rather hear it in five minutes than five days.
- If money or bank details were involved, call your bank using the number on the back of your card.
Test yourself: play Scam or Legit?, a quick free game.