Phishing

Phishing is a very common form of social engineering: the attacker sends a spoof message that looks as though it comes from somebody you trust, such as your school, a game's support team or a delivery firm. It is fake, but it is designed to look genuine so that you act without stopping to check.

The aim is to make you click a link and land on a fake website that copies the real one. Anything you type in, such as a username, password or card number, goes to the attacker, not the real organisation. A text might say that photos from a school trip are ready and ask you to sign in with your school account; the page looks exactly like the normal school login, so your password goes to the sender.

How it reaches you

Phishing is not only an email problem: it can also arrive as a text message, as a phone call from someone claiming to be a company, or face to face.

Warning signs

• Spelling and grammar errors, because real organisations check their messages.
• Website addresses that are slightly wrong, perhaps with an extra word or a different ending.
• Link text that does not match the address the link really points to.
• A greeting addressed to "customer" rather than to you by name, showing it was sent to many people at once.
• Pressure to act quickly, such as a warning that your account will be locked unless you sign in again.

Check the sender's address, and if you are unsure, contact the organisation using details you look up yourself. A genuine organisation is unlikely to ask for your password by email.

Reducing the risk

Spam filters catch many phishing emails before they reach an inbox, but some always get through. If one does, do not open attachments or click links. Scan any file with anti-virus software, then delete the message and report it.

Phishing is not malware: the message itself does not infect your device. It works by tricking you into giving information away, so spotting the signs is your best defence.