How to spot phishing and see through fake emails and messages
Fake invoices, parcel texts, account lockouts: how to recognise phishing, check links properly and know what to do if you have already clicked.
Phishing is an attempt to trick you into handing over passwords, bank details or money through fake messages. The messages often look convincingly real: with a logo, correct language and the right greeting. Still, they almost always give themselves away in the same places.
The typical scams
- Account lockout: “Your account has been restricted. Confirm your details within 24 hours.”
- Parcel delivery: a text message about a parcel with supposedly unpaid fees.
- Invoice or reminder: a supposed invoice as an attachment or link, often with an urgent payment deadline.
- Changed bank details: a “supplier” announces that their account number has changed. For businesses, large sums are quickly at stake here.
- CEO fraud: an email that appears to come from the managing director asks for an urgent, confidential transfer.
- Family member in trouble: “Hi Mum, this is my new number, I urgently need money.”
How to recognise phishing
1. Time pressure and threats. Deadlines of a few hours and threatened lockouts or charges are meant to stop you from thinking. Real banks and authorities don’t work like this.
2. The actual sender. The displayed name can be anything. Click or tap the name to see the real address. “PayPal Customer Service” with the address info@customer-security-24.com is a fake.
3. The link target. On a computer, hover over the link without clicking. The real address appears at the bottom of the browser. On a phone, a long press helps. Pay particular attention to the part right before .com, .co.uk or .de:
| Address | Genuine? |
|---|---|
https://www.royalmail.com/track-your-item |
Yes, belongs to royalmail.com |
https://royalmail.com.parcel-info.net/ |
No, belongs to parcel-info.net |
https://www.r0yalmail.com/ |
No, zero instead of O |
4. Unexpected attachments. Invoices from companies you haven’t ordered from, ZIP files or Office documents that ask you to “enable content”: don’t open them.
5. Requests for data the sender already has. Your bank knows your account number. No legitimate organisation asks for passwords, one-time codes or full card details by email.
When in doubt, check another way
Don’t click the link in the message. Instead, open the service’s app or type the known address into your browser yourself. If there really is a problem, you will see it there too. For supposedly changed bank details, call the supplier on the number you already know, not the one in the email.
What to do if you have already clicked
Only opened the link, entered nothing: usually nothing has happened. Close the page and let your antivirus scan the device.
Entered a password:
- Immediately change the password at the genuine service, and everywhere else you use the same password.
- Turn on two-factor authentication.
- Check the account settings for unknown devices that are logged in or forwarding rules that were set up, and remove them.
Entered bank or card details:
- Call your bank immediately and have the card blocked. The emergency number is usually on the back of the card and in your online banking.
- Watch your account transactions closely over the next few weeks.
- Report it to the police if money was taken.
Opened a file from the attachment: disconnect the device from the network and have it checked by a professional. At work, inform your IT team immediately.
Prevent phishing in your company’s name
Scammers also send emails with a faked sender address from your own company, for example to your customers. With SPF, DKIM and DMARC you make sure your customers’ mail servers recognise such fakes and filter them out. The email security check shows whether your domain is protected, and How to set up SPF, DKIM and DMARC explains the setup.
A password manager as phishing protection
An often overlooked benefit of a password manager: it only fills in login details on the genuine website. If it does not offer your login on a page that looks exactly like your bank, that is a clear warning sign.