Phishing messages impersonate a bank, shop, parcel service or authority and push you to a fake login page to "fish" for your passwords, card numbers or other personal data. They lean on urgency and a link that looks almost right.
Reviewed by Florian Wartner · Last updated
You receive an email, text message, or chat that appears to come from a bank, online shop, parcel service, or government office. It usually claims there is a problem - a blocked account, an unpaid customs fee, a failed delivery - and includes a link that takes you to a website that looks just like the real one.
The page is a copy controlled by criminals. Anything you type there, especially your login details or card number, is sent straight to them.
Phishing works because it uses brands you already trust and a sense of urgency that pushes you to act before you think. The messages are sent to millions of people at once, so the senders only need a small fraction to click.
Anyone can be targeted. Scammers count on a busy moment, a real pending parcel, or a genuine account that makes the message feel plausible.
Look closely at the sender address and the link. The display name may say your bank, but the actual address or web domain is often misspelled, uses extra words, or ends in an unusual way. Hover over a link before clicking to see where it really goes.
Generic greetings, threats of immediate consequences, requests to confirm a password or PIN, and unexpected attachments are all common red flags. A real bank will never ask you to enter your full login details through an email link.
Never click links in unexpected messages. Instead, open the website yourself by typing the address or using your own bookmark or app, and log in there to check. Turn on two-factor authentication so a stolen password alone is not enough.
If you already entered your details, change the password immediately on the real site, call your bank to block the card or account, and watch for unfamiliar charges. You can report phishing to your bank, the shop being imitated, and your national consumer or cybercrime authority.
Dear customer, we noticed unusual activity on your account. To avoid suspension, confirm your identity within 24 hours: hxxp://secure-bank-verify.com/login
Made-up example - not a real message.
