Phishing is when attackers pretend to be a trusted organisation or person to trick you into sharing passwords, payment details or other sensitive information, or into installing harmful software. It can arrive by email, text message, phone call or social media.

Common warning signs

  • Urgent or threatening language, such as claims your account will be closed.
  • Unexpected attachments or links.
  • Sender addresses or website names that are slightly misspelled.
  • Requests for passwords, one-time codes or payment details.
  • Offers that seem too good to be true.

What to do instead

Do not click links or open attachments from unexpected messages. If you are unsure, contact the organisation using a phone number or website you already trust, not the details in the message.

Extra protection

Use unique passwords and a password manager, and turn on two-step verification where available. Keep your devices and browser updated, since they can block many known malicious pages.

If you clicked

Change the affected passwords immediately, contact your bank if financial details were shared, run a security scan and report the message to the organisation being imitated and to the relevant cybercrime reporting channel in your country.

Takeaway

Attackers rely on haste. A pause to check the sender and the request stops most phishing attempts.