Spotting Phishing
Cybercriminals use convincing emails, text messages and fake websites to trick people into revealing information or installing malicious software. Learn how to recognise their techniques and protect yourself.
What is phishing?
Phishing is a form of social engineering. Attackers impersonate trusted organisations or individuals to manipulate people.
Their objective might be to steal passwords, obtain payment information, deliver malware or convince someone to transfer money.
The fake delivery message.
Imagine receiving this text message:
We were unable to deliver your parcel.
A small redelivery fee is required.
Update your details immediately:
https://parcel-redelivery.example
This is a fictional example, but it demonstrates several common phishing techniques.
Open the delivery company's official app or manually visit its known website. Check your delivery status there instead of following the message's link.
The urgent account warning.
Another common technique involves pretending that your account is at risk.
Subject: Your account will be suspended
Unusual activity has been detected.
You must verify your identity within 30 minutes to avoid permanent suspension.
VERIFY ACCOUNT NOW
Attackers use fear and urgency to encourage people to enter their credentials into fraudulent websites.
A familiar logo or professional-looking email doesn't prove that a message is genuine. Even a familiar sender address can be spoofed or belong to a compromised account.
Six warning signs.
Modern phishing messages can have perfect spelling and convincing branding. Don't rely on grammatical mistakes as your main warning sign.
Check the actual domain name.
Attackers often register domain names resembling legitimate websites.
https://accounts.example.com
Suspicious lookalike:
https://accounts-example.com
These fictional addresses look similar, but they represent different domains.
HTTPS and a browser padlock don't guarantee that a website is legitimate. Phishing websites can also use valid TLS certificates.
Unexpected files can be dangerous.
Phishing emails sometimes contain malicious attachments disguised as invoices, delivery notices or documents.
Some attempt to convince users to enable macros, install software or bypass security warnings.
Verify unexpected attachments directly with the sender using a trusted contact method. Never disable security protections simply because a document asks you to.
Already clicked a suspicious link?
What you should do next depends on what happened.
If the incident involves a work account or device, contact your organisation's IT or security team promptly.
Help protect other people.
In the UK, suspicious emails can be forwarded to the National Cyber Security Centre's reporting service.
report@phishing.gov.uk
Suspicious text messagesForward to 7726, where supported.
For current reporting guidance, visit the official NCSC website.
Think before you click.
Don't let urgency control your decision.
CHECKVerify the sender and destination independently.
PROTECTNever share passwords or verification codes.
REPORTReport suspicious messages through official channels.
Secure Your Devices.
Next we'll explore updates, backups, device encryption, application permissions and practical ways to protect your phone and computer.