How to Spot a Phishing Email or Text (Before You Click)

Fake delivery notices, bank alerts and prize messages — the warning signs and what to do if you've already clicked.

Editorial TeamNovember 4, 20261 min read

Phishing messages pretend to come from a company or person you trust, so you'll click a link, open an attachment or share personal details. They're getting more convincing, but most still share the same warning signs.

7 warning signs

Urgency or threats: "Your account will be closed today" or "Pay now to avoid a fine."
A strange sender address: the name looks right, but the email address doesn't match the real company.
Generic greetings: "Dear customer" instead of your name.
Links that don't match: hover over a link (or press and hold on a phone) to see where it really goes.
Requests for passwords or codes: real companies won't ask for these by email or text.
Unexpected attachments or invoices you don't recognise.
Offers that are too good to be true, like prizes you never entered.

Golden ruleIf a message worries you, don't use its links. Open the company's app or type its website address yourself to check your account.

Common scams

Missed parcel delivery messages with a small "redelivery fee"
Fake bank security alerts
Tax refund or fine notices
Messages from a "family member" with a new number asking for money

If you've already clicked

Don't enter any more information.
If you entered a password, change it straight away — and on any other site where you used it.
If you shared bank details, contact your bank immediately using the number on your card.
Turn on two-factor authentication for your important accounts.
Run a security scan on your device.

Report it

Forward phishing emails to the company being impersonated or your country's official scam reporting service, then delete them. Reporting helps protect other people too.