How to Spot a Phishing Scam Before It’s Too Late
Phishing scams have gotten noticeably more convincing over the past few years — the crude, typo-filled emails of a decade ago have largely been replaced by messages that closely mimic real banks, delivery services, and companies you actually use. Here’s how to spot a phishing scam before you click and what to do if you already have.
What Phishing Actually Is
Phishing is any attempt to trick you into handing over sensitive information — passwords, credit card numbers, verification codes — or into installing malware, usually by impersonating a legitimate company or person you’d normally trust. It arrives most commonly through email, but text message phishing (“smishing”) and phone call phishing (“vishing”) have both become significantly more common as people have gotten more cautious about email specifically.
The Warning Signs Worth Knowing
A false sense of urgency. Messages claiming your account will be suspended, a package couldn’t be delivered, or suspicious activity was detected — all demanding immediate action — are a classic pressure tactic. Legitimate companies rarely demand you act within minutes or hours; scammers rely on panic to short-circuit your usual caution.
The sender address doesn’t quite match. Look closely at the actual email address or phone number, not just the display name. A message claiming to be from “Apple Support” sent from an address like this support@apple-verify-account.com is not from Apple — legitimate companies send from their actual domain, not a lookalike.
Generic greetings on messages claiming to be personal. “Dear Customer” or “Dear Valued User” from a company that would normally know your name is a common tell, though it’s worth noting that more sophisticated phishing attempts have started using your actual name, pulled from previous data breaches — so a personalised greeting alone doesn’t guarantee legitimacy.
Links that don’t go where they claim to. On desktop, hover over a link (without clicking) to see the actual destination URL in your browser’s status bar. On mobile, press and hold a link to preview the destination. If the actual URL doesn’t match the company it claims to be from, don’t click it.
Requests for information a legitimate company wouldn’t ask for this way. Your bank will never ask you to text or email your full password or PIN. Any message asking you to “verify” sensitive credentials directly through a link, rather than by logging into the company’s app or website yourself, should be treated as suspicious by default.
Unexpected attachments, especially ones prompting you to “enable content” or “enable macros”. This is a common malware delivery method disguised as an invoice, shipping document, or similar file — legitimate companies rarely send unexpected attachments requiring you to change a security setting to view them.
Slightly off branding or formatting. AI tools have made phishing emails far more polished than they used to be, but subtle inconsistencies — an outdated logo, unusual formatting, or phrasing that’s just slightly off from how the real company communicates — can still be a useful tell if you’re familiar with a company’s usual style.
Newer Phishing Tactics Worth Knowing
QR code phishing (“quishing”). Scammers have started embedding malicious QR codes in emails or even physical flyers and parking meters, since QR codes bypass a lot of people’s usual instinct to check a link before clicking. Treat an unexpected QR code with the same suspicion as an unexpected link.
AI-generated voice phishing. Voice cloning technology has made phone-based scams — including calls that sound like a real family member in distress — more convincing than ever. If you get an urgent, emotionally charged call asking for money or sensitive information, hang up and call the person back directly using a number you already have, rather than trusting the incoming call.
Fake customer support numbers in search results. Scammers have gotten better at getting fraudulent “customer service” phone numbers to appear prominently in search results or fake ads. Always get a company’s support number directly from their official app or website, not from a search result you clicked into.
What to Do If You Suspect Phishing
- Don’t click any links or download any attachments.
- Verify independently — if a message claims to be from your bank, open your bank’s app directly (not through the message) or call the number on the back of your card, rather than any number provided in the suspicious message.
- Report and delete it. Most email providers have a “Report Phishing” option, and reporting helps improve spam filtering for everyone.
- If you already clicked a link or entered information, change the affected password immediately, enable two-factor authentication if you haven’t already, and monitor the relevant account closely for unauthorised activity.
Bottom Line
Modern phishing attempts are genuinely harder to spot on sight than they used to be, which makes it more important to build a habit of pausing before you click anything urgent, checking the actual sender and link destination, and verifying independently rather than trusting a message at face value. When in doubt, go directly to the company’s app or official website yourself rather than clicking through — it costs you thirty extra seconds and closes off nearly every phishing attempt at once.
This is general security guidance; if you believe you’ve already been the victim of a scam involving financial loss, contact your bank or card issuer directly and consider reporting it to your local authorities or a relevant consumer protection agency.
