Phishing: how to spot fake messages and websites

Phishing is when a scammer pretends — with a fake message or website — to be a trusted authority (a bank, a messenger, an email provider, the post) so that you type in your password, a code, or your card details yourself. It works because it exploits people, not software, but the signs are recognizable.

Signs of a fake message

• Urgency and fear: "your account will be blocked", "verify within 24 hours".
• Asking for passwords or codes: real services never ask for your password or one-time codes in a message.
• Short or odd links: the destination does not match the real service's name.
• Spelling mistakes and odd tone — though modern phishing is sometimes flawless.
• An unknown sender; display names can be faked, read the actual address.
• Prizes or grants you never applied for.

Signs of a fake website

• Read the domain. Don't hunt for the padlock; look at the address itself. The important part is the main domain (before the first /). Watch for swapped letters (like o vs 0) and added words (like -login).
• The HTTPS padlock does not save you; phishing sites can have HTTPS too (explained).
• A login page opened from a message link instead of an address you typed yourself.
• Asking for extra details (CVV2, the card's second password) where it makes no sense.

What to do

1. Don't click message links; type the site's address yourself or use your bookmark. 2. If you are worried about the account, log in through the official app or site and look for notices there. 3. Use a password manager: it only fills the password on the right domain. If it doesn't fill, the domain is not what you think. 4. Turn on two-factor authentication (guide). Even with a leaked password it blocks login — but never read the code to anyone, not even "support".

If I already clicked or gave information?

• Change that account's password immediately (and anywhere you reused it) (strong password guide).
• If you gave card details, call the bank and block the card.
• Close active sessions (log out from all devices) in security settings.
• If you installed something, scan the phone or computer.
• Report the incident to the service involved.

For site owners

If your site has logins, take user education, 2FA and login rate limits seriously. And never email "enter your password here" links — that habit trains users to accept phishing.

Common questions

Is phishing email-only? No — SMS (smishing), phone calls (vishing), messengers and even fake ads are the same family.

Does antivirus stop phishing? It catches some cases, but your attention plus 2FA are the main defense.