Phishing: how to spot scam messages and websites

Phishing is a type of fraud in which criminals pretend to be your bank, the post office, a delivery service, a friend or "support" to get you to enter a password, a code from a text message, your card details or to install a malicious app.

Phishing is bait wrapped in an urgent message

In plain words

Phishing comes from "fishing". The scammer casts the "bait": "Your parcel has been held", "Your account will be blocked", "You have won an iPhone". The fish - that is, the person - grabs the bait in a hurry and ends up on the hook. Phishing's main weapon is not technology but haste and emotion.

How it works

You receive a message, email, call or ad with an urgent demand.
The link leads to a site that looks real but has a different address.
You are asked to enter a password, a text-message code or your card details.
The scammers immediately use that data to get into your account or take your money.
Modern phishing uses AI: flawless texts, cloned voices and deepfakes.

Stop and check the address before entering any details

Where you'll see it

In text messages and messaging apps (especially "from a delivery service" or "from your bank"), emails, fake social media pages, "giveaway" ads, gaming chats (skin trades, "free currency") and calls from the "bank security team".

Does it matter when buying

A lot - it is the most common way to lose an account or money. My rules: do not follow links in unexpected messages - open the app yourself; never tell anyone a code from a text message; check the website address; turn on 2FA or passkeys. And if a message says "urgent", that alone is a reason to stop and think.

Myths

Myth: Phishing is easy to spot by its mistakes. Reality: Modern phishing messages are often flawless - AI writes them well.
Myth: I will not be fooled; I am careful. Reality: Scammers count on tiredness and haste - anyone can be fooled.

FAQ

What if I entered my password on a phishing site?

Change it immediately, sign out of all sessions, turn on 2FA and, if it was your bank, call the bank.

How do I check a link?

Look at the address: watch for extra letters, odd domains and shortened links.

Can a bank ask for a text-message code?

A real bank never asks you to read out a code - hang up.