Phishing is a scam where someone fakes a trusted message — an email, text, or a website — to trick you into giving away passwords, card numbers, or money, or to install malware. It's the most common way ordinary people end up compromised, and it's getting more convincing.

The classic signs

  • Urgency and fear: "your account will be suspended in 24 hours," "we detected unusual activity."
  • A lookalike sender or address: support@paypa1.com instead of paypal.com.
  • A link that isn't the real domain: hover over it. yourbank.com-secure-login is not your bank.
  • A nudge to act now and a button to click.
  • Unexpected attachments, especially .zip or .exe.

What to do

  • Don't click links in the message. If the bank says something, go to their real site or app and log in directly.
  • Check the sender's full address, not just the display name.
  • When in doubt, report it (mark as phishing / junk) and delete.
  • Turn on two-factor authentication — it stops most stolen-password logins.

"But it looked genuine"

The best phishing is genuinely hard to spot, and that's the point. Your defence isn't spotting every trick — it's the don't click, go direct habit and two-factor authentication.

The one rule that defeats most phishing: never type your password into a page you got to by clicking a link in an unexpected message. Go to the site yourself.