Spotting Phishing Messages

Phishing messages are fake emails or texts that pretend to come from an organisation you trust. They rely on you acting before you think, so they carry warning signs you can learn to spot.

Warning signs

• Generic greeting — a company that really holds your account knows your name, so a message that greets nobody by name has been sent to thousands of people at once.
• Urgency or threats — such as “pay the 99p owed within 12 hours or your tickets go back on sale”. The rush is deliberate: it stops you looking closely at anything else.
• A sender address or link that does not match the organisation — the display name can look right while the real address does not, such as support@gamehub-billing.net instead of the company's own domain. Read a link's address before you click it.
• Spelling and grammar mistakes — real organisations check their messages carefully before sending them, though a neat message can still be fake, so weigh up every sign together.
• Requests for passwords or bank details — a genuine organisation will not ask you to send these in a message, so that request alone is a warning sign.

Taking a message apart

A text arrives saying you have been picked for a £100 voucher: “Claim it within 15 minutes through the link below by entering your username and password.” Nobody is named, there is a deadline, a link and a request for login details — four signs in three lines.

What to do instead

Do not follow links or open attachments in a message you were not expecting. Instead, contact the organisation using official contact details you found independently — the address on its own website, or the number on your account paperwork — and ask whether the message is real.

Following a link can be harmful even if you download nothing: it may open a fake copy of a login page, and whatever you type into it goes straight to the attacker.