Start with the request, not the appearance
A phishing message is an attempt to get you to take an action that benefits the sender, such as revealing a password, opening a harmful file, or visiting a fake sign-in page. It may arrive as an email about a delivery, a text about an account problem, or a note that appears to come from a coworker. The most useful first question is not “Does this look professional?” but “What is this asking me to do?”
Pause when a message presses you to act immediately, keep a request secret, provide a verification code, or sign in through a supplied link. Fear and urgency can make ordinary checks feel inconvenient. A genuine problem may still need attention, but you can usually investigate it without using the message’s link, attachment, phone number, or reply button.
Check who sent it and where it wants to take you
Read the full sender address, not just the display name. A familiar company name can be paired with an unrelated email address. In a text, a recognizable name or a message in an existing conversation is not proof of identity either. Sender details are clues, not guarantees, because accounts can be compromised and some sender information can be imitated.
Before opening a link, inspect its destination if your device makes that possible. On a computer, hovering over a link may reveal the address; on a phone, pressing and holding may show a preview, though you should avoid selecting an option that opens it. Look at the actual website name, not only words placed before or after it. A link can contain a brand name while leading to a different site. Shortened links and QR codes make the destination harder to judge, so treat unexpected ones with extra caution.
Do not rely on spelling mistakes as your main test. Phishing messages can be polished, while legitimate messages can be awkward. Unexpected attachments, requests to enable document features, and sign-in pages reached from an unsolicited message deserve closer scrutiny even when the writing looks convincing.
Verify the claim through a separate route
If a message says there is a problem with an account, open the organization’s app yourself or type its known website address into your browser. You can also use a bookmark you created earlier. Check for the alert there rather than following the message’s path. If you need to call, use a number from a source you already trust, not one supplied in the suspicious message.
For a request that appears to come from someone you know, confirm it through another channel. A quick call to a coworker or a new message to a saved contact can help establish whether they really sent an unusual request. This is especially useful when the message asks for credentials, payment details, a file, or a change to a familiar process. Verification is not an accusation; it is a routine check before acting on a high-impact request.
Use a simple before-you-click routine
First, identify the requested action: click, download, reply, call, or share information. Second, ask whether you expected this message and whether the request fits what you normally do with that sender. Third, examine the sender and destination without opening anything. Finally, verify the claim independently if it concerns an account, money, personal information, or a work system.
If you cannot verify a message, leave it alone rather than testing its link. You can mark it as spam or phishing using your mail or messaging app’s reporting option. In a workplace, follow your organization’s reporting process. Reporting helps the people who manage the account or system investigate, and deleting the message afterward can keep you from accidentally revisiting it.
If you already clicked, focus on what happened next
Opening a page is different from entering a password, downloading a file, or granting an app permission. Close the page and avoid submitting anything else. If you entered a password, go directly to the real service and change it there; change it anywhere else you reused it. Review available account activity and security settings, and enable multifactor authentication if the service offers it. Never give a sign-in code to someone who contacts you unexpectedly.
If you downloaded or opened a file, follow your device’s security guidance and run its available security checks. If the device or account belongs to an organization, tell its IT contact promptly and describe what you did. A quick, factual report is more useful than waiting to see whether something goes wrong. Phishing prevention is not about spotting every fake at a glance; it is about building a habit of checking before a message directs your next step.
