Start with the request, not the appearance
Phishing is an attempt to trick you into giving away information, sending money, or opening something harmful. It can arrive by email or text and may pretend to come from a delivery service, a bank, a workplace, or someone you know. Some messages look sloppy, but others copy familiar logos and use convincing language. A polished design is not proof that a message is genuine.
Before you act, ask what the message wants you to do. Be especially cautious if it asks you to enter a password, share a one-time sign-in code, update payment details, open an unexpected attachment, or move a conversation to another app. A message may create urgency by warning that an account will close or a package will be returned. The problem it describes might be plausible; the pressure to resolve it through that particular message is the reason to slow down.
Check the sender and destination
A display name is easy to mistake for an identity. An email might show a familiar company name while the actual sending address is unrelated. In a text, a contact name or a number that looks familiar is not a guarantee either. Check the full address or number when your device lets you, but treat it as one clue rather than a final answer: sender details can be misleading.
Look closely at where a link would take you before opening it. On some devices, you can press and hold a link to preview its destination without visiting it; if the preview is unclear, leave it alone. A short link, a slightly misspelled web address, or an address with extra words around a brand name deserves caution. QR codes in messages deserve the same treatment as links because they can send you to an unfamiliar site. You do not need to solve a confusing address to stay safe—you can choose a different way to reach the service.
Verify through a route you choose
If a message claims there is a problem with an account, open the company’s app yourself or type in the web address you normally use. For a delivery notice, check an order confirmation or your account’s order history rather than using the message’s tracking link. If someone you know asks for money or a code, contact them through a method you have used before. Do not use the phone number or reply address supplied in the suspicious message as your only way to verify it.
Context helps, too. Were you expecting this document, sign-in prompt, or delivery? An unexpected message is worth checking even if it includes your name or other accurate details. At the same time, a real message can be brief or contain a typo. Instead of deciding based on a single feature, ask whether you can confirm the request independently. If you cannot, it is reasonable to leave it unanswered while you investigate.
Build a simple pause-and-check habit
A useful routine is: stop, identify the request, and verify elsewhere. You can apply it in a few seconds before tapping a link or opening a file. Be particularly careful when a message combines a deadline with a request for secrecy, payment, or a sign-in code. Legitimate account checks should not require you to give a one-time code to someone who contacted you unexpectedly.
Keep your phone, computer, browser, and apps updated, and use unique passwords for important accounts. A password manager can help you create and store them. Where available, turn on multi-factor authentication for another layer of protection. These steps cannot tell you whether a particular message is safe, but they can reduce the harm if a password is exposed.
What to do if you already responded
If you clicked a link but did not enter anything, close the page and avoid downloading files from it. If you entered a password, go directly to the real service through its app or a known address and change that password. Change it anywhere else you reused it, too. If you shared a sign-in code, payment information, or other sensitive details, contact the relevant account provider or card issuer through its official app or a number you already trust. Check your account activity and follow their guidance.
If you opened an unexpected attachment or installed something, run your device’s built-in security checks and seek trusted technical help if it behaves strangely. You can also use your email or messaging app’s report and block features. There is no benefit in replying to argue with the sender. Phishing works by catching people during ordinary, busy moments; responding calmly and promptly matters more than feeling embarrassed.
