How to spot a phishing email or text (and what to do if you've already clicked)

Phishing is a scam where someone poses as a company, bank, government agency or trusted person to get you to do something: click a link, enter your details, download a file or make a payment. By text message it's often called smishing; by phone, vishing. The messages keep getting more convincing, but nearly all share patterns you can learn to recognise.

#Warning signs

#1. Urgency or fear

"Your account will be locked in 24 hours", "Final notice: parcel on hold", "We've detected a suspicious charge". Urgency is meant to make you act before you think.

#2. They ask for things they'd never ask for this way

No bank will ask by email or text for your full password, your PIN, the verification code you just received, or your full card details.

#3. The sender doesn't add up

• The email address doesn't match the official domain — support@bank-security-online.com instead of the bank's real domain.
• The display name looks right, but the address behind it doesn't.
• Texts from unknown numbers claiming to be your bank. Note that scammers can spoof the sender so a text lands in the same thread as genuine messages.

#4. The link goes somewhere else

A link's text can say one thing and lead to another. Look at the actual domain:

• https://www.mybank.com/login → domain mybank.com.
• https://mybank.com.customer-verify.net/login → the real domain is customer-verify.net, not your bank.

The domain is the part just before the first /, read from right to left from there.

#5. Small payments or odd payment methods

"Pay a £1.99 redelivery fee", "buy gift cards", "send money to receive a refund". Classic fraud patterns.

#6. Unexpected attachments

Invoices, fines or "scanned documents" you weren't expecting, especially zipped files or documents with macros. See how to tell if a download is safe.

#7. "Hi Mum, new number"

"My phone broke, this is my new number, can you transfer some money?" Call their old number before doing anything.

#How to check without risk

• Don't use links or phone numbers from the message. Open the official app or type the website address yourself.
• On a computer, hover over the link without clicking and read the real address, usually shown at the bottom of the browser.
• On a phone, long-press the link to preview the address without opening it.
• Call the company on its official number — from its website or the back of your card.

#If you've already clicked or shared details

Act fast and don't be embarrassed — it happens to plenty of people.

1. If you entered a password: change it immediately via the official site or app, and anywhere else you use it. Turn on two-factor authentication.
2. If you gave card or bank details: call your bank on its official number to block the card and review transactions.
3. If you downloaded and installed something: disconnect from the internet, run an antivirus scan and, on a phone, uninstall the app.
4. If you made a payment: contact your bank as soon as possible — sometimes a transfer can still be stopped.
5. Check your accounts for changes you don't recognise. If you think someone's got in, follow how to recover a hacked account.
6. Report it to the police if you've lost money or been impersonated.

#Where to report

• United States: the FTC explains how to report phishing at ReportFraud.ftc.gov, and you can forward scam texts to 7726 (SPAM).
• United Kingdom: forward suspicious emails to report@phishing.gov.uk and scam texts to 7726; the NCSC explains how.
• Elsewhere: check your national CERT or cybersecurity agency.

Also use your email's "Report phishing" or "Spam" button and block the number on your phone.

#The bottom line

Most scams fall apart under three questions: Am I being rushed? Are they asking for data or money in an unusual way? Does the link or sender match the official one? When in doubt, don't click — go through the official app or website. And if you've already been caught, change passwords, call your bank and get help: acting within the first few hours greatly limits the damage.