How to Recognise Phishing Emails, Texts and Scam Calls

Phishing is any attempt to trick you into giving away passwords, money or personal information – or into installing malware – by pretending to be someone you trust. It arrives by email, text message (“smishing”), phone calls (“vishing”), social media and even QR codes. Scammers increasingly use AI tools to write convincing messages, so spelling mistakes are no longer a reliable giveaway. Learning to recognise the tactics is what protects you.

The six warning signs

1. Urgency or threats

“Your account will be closed in 24 hours.” “Unusual sign-in detected – verify now.” “Final notice: unpaid invoice.” Scammers create pressure so you act before thinking. Legitimate organisations rarely demand immediate action through an unexpected message.

2. A request for sensitive information or payment

Be suspicious of any message asking you to confirm passwords, one-time codes, bank details, or to pay by gift card, cryptocurrency or bank transfer. Your bank will never ask for your full PIN or password, and no legitimate company needs your two-factor code.

3. A mismatched sender or link

Look closely at the sender’s actual email address, not just the display name. “Microsoft Support” might be sending from a random address. On a computer, hover over a link (without clicking) to see where it really goes. Watch for look-alike domains such as micros0ft-support.com, extra words (paypal-security-check.com) or unusual endings.

4. Unexpected attachments

Invoices, delivery notices, shared documents and voicemail messages you weren’t expecting are classic lures. Be especially wary of compressed files (ZIP), HTML attachments and Office documents that ask you to “enable content” or “enable macros”.

5. Too good to be true

Prizes, refunds, investment opportunities with guaranteed returns, or a job that pays well for little work are common hooks.

6. Something just feels off

A colleague emailing at an odd hour with an unusual request, a supplier suddenly changing bank details, a friend’s social account asking for money – trust your instinct and verify.

Common scams to know

• Fake delivery texts asking you to pay a small “redelivery fee”, which captures your card details.
• Account security alerts claiming someone has signed into your Microsoft, Apple, Google or bank account, linking to a fake login page.
• Invoice and payment fraud targeting businesses, where scammers impersonate suppliers or executives to redirect payments.
• Tech-support scams: pop-ups claiming your computer is infected with a phone number to call, or unsolicited calls from “Microsoft” or your internet provider. They aim to get remote access to your computer or payment for fake fixes.
• QR code phishing: QR codes in emails, posters or parking meters that lead to fake payment or login pages.

How to check a suspicious message safely

1. Don’t click links or open attachments in the message.
2. Contact the organisation independently: type the website address yourself, use the official app, or call a number from their official website or the back of your card.
3. For colleagues or friends, confirm through a different channel – call them, or message them on a different platform.
4. Use your email’s “Report phishing” option to help filters learn.

A useful rule: if a message asks you to act, go to the source yourself rather than following the message.

What to do if you clicked or replied

Act quickly – it limits the damage.

• Entered a password? Change it immediately on the real website, plus anywhere you’ve reused it. Turn on two-factor authentication. Check for unfamiliar email forwarding rules and sign-in activity.
• Shared card or bank details? Contact your bank straight away using the number on your card. They can block the card and watch for fraud.
• Opened an attachment or installed something? Disconnect from the internet, run a full scan with your security software (Microsoft Defender’s offline scan is a good option on Windows), and seek professional help if you’re unsure.
• Gave someone remote access? Disconnect from the internet, uninstall the remote-access software, scan the computer, change passwords from a different device, and contact your bank.
• At work? Tell your IT or security team immediately – quick reporting can protect your colleagues too. Nobody should be blamed for reporting a mistake.

Report it

• UK: forward emails to report@phishing.gov.uk and texts to 7726. Report fraud to Action Fraud (or Police Scotland in Scotland).
• US: report to the FTC at ReportFraud.ftc.gov and forward phishing emails to reportphishing@apwg.org.
• Canada: the Canadian Anti-Fraud Centre. Australia: Scamwatch and ReportCyber.

Conclusion

Phishing relies on urgency and trust. Slow down, check the real sender and link, never share passwords or codes, and verify through an independent channel. Combined with unique passwords managed by a password manager and two-factor authentication, these habits stop the vast majority of scams.