Updated September 2026. The tricks change; the shape of the attack does not.
Phishing works on attention, not on technology. A message arrives that looks routine, creates a reason to hurry, and asks you to sign in or pay. Nothing is hacked — you are asked. This guide covers the forms it takes now, the signals that give it away, exactly what to do if you have already clicked, and the handful of habits that make you a hard target.
The shape of every phishing attack
- A trusted face — your bank, a delivery company, a colleague, a supplier.
- A reason to act now — a failed payment, an account closing, an unpaid customs fee, an urgent request from the boss.
- A single action — click this link, open this attachment, read me this code, change these bank details.
Recognising the pattern matters more than memorising examples, because the examples change monthly.
The forms it takes now
| Type | How it arrives | What gives it away |
|---|---|---|
| Email phishing | A mass message impersonating a well-known service | A sender domain that is nearly right; a link that does not match the brand |
| Text and messaging scams | Missed delivery, unpaid toll, bank alert | Urgency plus a shortened link; real firms rarely take payment by text link |
| Phone calls | “Fraud department” ringing about suspicious activity | They ask you to move money or read a code — banks never do either |
| QR codes | A sticker on a parking meter, a code in an email or PDF | You cannot see where it leads until you are there; check the address before typing anything |
| Business email compromise | A supplier emails new bank details, or “the director” asks for an urgent transfer | Payment details changing by email, and pressure not to check |
| Approval fatigue | Repeated two-factor prompts until you tap Approve | Any prompt you did not start is an alarm, not an annoyance |
| Fake support | A search result or social media reply offering help | They want remote access to your computer, or a payment in gift cards |
The signals that still work
- Check the sender’s domain, not the display name. Anyone can put “Your Bank” in the name field.
- Hover or long-press a link and read the address. Look at the part just before the first single slash — that is the real site.
- Distrust the emotion. Fear, urgency, secrecy and flattery are the tools; a legitimate organisation gives you time.
- Unexpected attachments — especially invoices, delivery notes and anything asking you to enable content.
- A password request. No real service asks for your password by message, and none ask you to read out a verification code.
- Payment details that changed. Always verify by ringing a number you already had, not one in the message.
Two signals people over-rely on: spelling mistakes and the padlock icon. Modern phishing is written well — sometimes with AI — and almost every phishing site has a valid certificate. The padlock means the connection is encrypted, not that the site is honest.
The habits that protect you when you miss the signs
- Never sign in from a link in a message. Open the app, or type the address yourself. This single habit defeats most phishing.
- Use a password manager. It will not auto-fill on a lookalike domain — which makes it an excellent lie detector. See our guide to password managers.
- Turn on two-factor authentication, and prefer passkeys or an app over text codes. The 2FA setup guide covers the steps.
- Verify money requests out of band. A phone call to a known number, every time bank details change.
- Keep devices updated so a bad click is less likely to become a bad day.
If you already clicked
- Did you enter a password? Change it immediately on the real site, and anywhere you reused it. Then sign out all sessions in the account’s security settings.
- Turn on two-factor for that account if it was not on, and check for unfamiliar devices, forwarding rules or recovery addresses that you did not add.
- Did you enter card details? Call your bank, freeze or replace the card, and watch for small test charges.
- Did you pay? Contact your bank straight away — speed matters — and ask about recovering the payment.
- Did you install something or grant remote access? Disconnect from the internet, run a full scan, and change passwords from a different device.
- Report it to the impersonated company and to your national fraud reporting service, and tell your colleagues if it arrived at work.
- Watch your accounts for a few weeks. See what to do when your data is exposed.
If other people use your business email
- Make the reporting route obvious. Staff who fear blame stay quiet, and silence is what turns one click into an incident.
- Agree a rule for payment changes: no bank detail is ever changed on the strength of an email.
- Ask whoever manages your domain about SPF, DKIM and DMARC — email authentication that makes it harder for anyone to send messages that appear to come from your address.
- Practise, briefly and kindly. A five-minute conversation about a real example beats an annual training slide deck.
Frequently asked questions
Is it dangerous just to open a phishing email?
Opening it is usually harmless. The risk comes from clicking a link, opening an attachment, or replying. Modern mail apps block remote images by default, which is why an unexpected “enable images” prompt is worth ignoring.
How can criminals fake a real sender address?
Email was not designed with identity checks, so the sender name and even the address can be forged. Authentication standards help mail providers detect it, but nothing catches everything — which is why the habit of never signing in from a link matters more than any filter.
Do I need to report it if nothing happened?
Reporting helps others: providers use it to block campaigns, and companies use it to warn customers. It takes a moment, and at work it also gives your team a heads-up that a campaign is running.
Are password managers safe against phishing?
They are one of the strongest defences, because they match the site address before filling. If your manager does not offer to fill on a login page you expected, treat that as a warning rather than a glitch.
Related guides
- Password managers for beginners
- Two-factor authentication setup guide
- Online banking security
- What to do when your data is exposed in a breach
