Your bank says your account will be locked in two hours. A delivery company says your parcel is stuck and needs a small fee. Your boss messages asking you to buy gift cards urgently. One of these messages is sitting in somebody's inbox right now, written in perfect English, carrying the right logo, and linking to a page that looks exactly like the real thing. That is what phishing looks like in 2026, and it is why the old advice to look for spelling mistakes no longer protects anyone.

Phishing is a message designed to make you act before you think. It pretends to come from someone you trust — a bank, a delivery firm, a tech company, a colleague, even a government department — and it wants one of three things: your login details, your payment information, or a click that installs malware or hands over control of your session. This guide teaches you to spot it in under a minute, whatever channel it arrives on, and what to do on the occasions when a message slips past you.

Three changes have made phishing much more convincing in the last two years. First, artificial intelligence now writes the messages. A scammer no longer needs to write English well, because a language model can produce a polished, personalised email for about the cost of a text message, and it can tailor it with your name, your employer, or a service you actually use. Second, the attack has moved beyond email. Texts, WhatsApp messages, social media direct messages, QR codes on posters and in PDF attachments, and cloned-voice phone calls are all phishing channels now. Third, the fake websites have improved. Modern phishing kits sit between you and the real site, capture your password and your one-time code in real time, and pass you through to the genuine service so nothing looks wrong.

The scale explains why you see so much of it. The FBI's Internet Crime Report recorded 191,561 phishing and spoofing complaints in 2025, the highest-volume cybercrime category it tracks. Microsoft reported detecting around 8.3 billion email-based phishing threats in the first quarter of 2026 alone, and its 2026 Digital Defense Report found phishing was the starting point in 23 percent of the intrusions its response teams handled, up from 7 percent the year before. You do not need to memorise these numbers. You only need to accept the conclusion they point to: phishing is not rare, it is not aimed only at careless people, and it will reach your inbox and your phone whether you are careful or not. The skill that matters is what you do in the ten seconds after it arrives.

Scammers can copy a logo, a colour scheme, a signature block, and even a company's writing style. A polished message proves nothing. The fastest test is to ignore how the message looks and ask one question instead: what does the sender want me to do? If the answer is to click a link urgently, download an attachment you did not ask for, share a password or verification code, send money, or keep the conversation secret, treat the message as suspicious until proven otherwise. Legitimate companies almost never ask for your password, your full card number, or a one-time code by email or text, and no genuine support agent will ever ask you to read out a code that was just sent to your phone. Anyone who asks for a verification code is, by definition, trying to take over your account.

The second question is just as fast: was I expecting this? An unprompted warning about an account you rarely think about, a delivery you did not order, a refund you did not request, or an invoice you do not recognise deserves verification before action. Verification means going around the message, not through it. Open the company's official app yourself, type its website address yourself, or call a number from the back of your card or the company's official site. Never use the link, the phone number, or the reply button inside a suspicious message, because all three can be controlled by the sender.

No single clue proves a message is fake, and no single clue proves it is safe. Phishing detection works by adding clues together. Run through this list whenever a message asks you to act, and treat two or more hits as a stop sign.

1. Urgency and threats. 'Your account will be closed in two hours', 'final notice', 'immediate action required'. Real companies give you time and a way to check. Scammers give you a countdown because a calm person does not click. 2. An unexpected request for credentials or codes. Passwords, PINs, one-time codes, and full card numbers are never requested by email or text. 3. A sender address that does not match. The display name may say your bank, but the actual address is something like support-billingdesk.com or a free mailbox. On a phone, tap the sender name to reveal the real address or number before deciding anything.

4. A link that does not go where it claims. Hover over it on a computer, or long-press it on a phone to preview the destination, without tapping. Look for misspellings, swapped letters, extra words, or a familiar brand name buried in a longer address, such as yourbank-secure-login.com or a shortened link that hides the destination entirely. 5. A generic greeting. 'Dear customer' or 'Dear user' in a message about your personal account suggests a mass mailing, since a real bank or service normally uses your name. 6. An attachment you did not ask for, especially an invoice, a scanned document, or a file that urges you to enable macros or content. Nearly one in three attachment-based phishing attempts uses a PDF, which is also where QR-code scams increasingly hide.

7. A payment method that is hard to reverse. Gift cards, cryptocurrency, wire transfers, and payment-app transfers are the payment methods of scams, not of refunds or official fees. Any message that steers you toward one of them is a scam until proven otherwise. 8. A prize, refund, or offer that is too good to be true. Unexpected winnings, tax refunds, and free devices are bait, and they work because excitement switches off the same caution that fear does. 9. Secrecy. 'Do not tell your manager', 'keep this between us', or a request to move the conversation to a private channel is a control tactic, not a courtesy.

10. A mismatch between the story and the channel. A bank does not close accounts by WhatsApp, a tax authority does not demand payment by text, and a delivery company does not ask you to pay a redelivery fee through a link in an SMS you never signed up for. 11. Slightly wrong branding or language. AI has made most scam messages fluent, but odd phrasing, inconsistent fonts, or a logo that looks stretched or low-resolution still appears, especially in forwarded or copied templates. 12. A CAPTCHA or extra step before the login page. Some phishing pages now put a CAPTCHA in front of the fake sign-in form specifically to block automated security scanners. A real sign-in page does not normally hide behind a puzzle.

On a computer, hover your mouse over the link and read the address shown in the bottom corner of the browser. On a phone, long-press the link and choose the preview option; do not tap through. Read the domain from right to left: the part immediately before the first single slash after the address is the real domain. In yourbank.com.secure-login.net, the real domain is secure-login.net, not yourbank.com. Shortened links hide the destination completely, so never trust one in an unexpected message; if the offer is real, you can reach it by opening the company's app or typing its address yourself. Remember also that a padlock icon and an address starting with https only mean the connection is encrypted. A fake login page can have a padlock too. Encryption is not trust.

If you are still unsure, search for the company and the topic separately. A real security alert, outage, or delivery problem usually appears on the company's official status page or help centre. A scam usually appears in scam-reporting forums, with other people describing the exact same message. Either way, you have answered the question without touching the link.

Email gives you the most to inspect, so use it. Check the sender's full address, not just the display name, and check the reply-to address as well, because scammers often send from one address and set replies to go to another. Be suspicious of a message that arrives at an odd hour for the supposed sender, or that references an account, order, or subscription you do not have. Treat any attachment with caution, and never enable macros or 'enable content' in a document from an unexpected sender; that button is how many infections start. If your email service offers a 'report phishing' button, use it. Reporting takes two seconds, trains the filter for everyone, and is the correct response even when you are only fairly sure.

Text phishing, often called smishing, usually impersonates a delivery company, a bank, a toll operator, or a government service. The classic lines are 'your parcel could not be delivered', 'unpaid toll fee', 'suspicious activity on your account', and 'your package is held pending a small customs fee'. The pattern is always the same: a small problem, a small payment or a login, and a link. Real delivery companies do not ask you to pay redelivery fees through random links, and real banks do not send account warnings with login links by text. Do not call a number given in the message either; look the number up independently. On most mobile networks you can forward a spam text to 7726, which spells SPAM on a keypad, and your carrier uses the report to block the sender.

Chat-app phishing adds one more trick: impersonating someone you know. A message from a friend's hacked account, or a new account using their photo and name, asks for a code, a loan, or a favour. The defence is a separate channel. If a friend urgently asks for money or a code by message, call them on their known number or speak to them in person before doing anything. The same rule covers supposed messages from your boss: a genuine urgent request survives a two-minute check, and a scam does not.

Voice phishing, or vishing, has become harder because AI voice cloning can imitate a real person's voice from a few seconds of audio taken from a video or a voicemail. A call that sounds exactly like a relative in trouble, or a bank's fraud team, is no longer proof of anything. The defence is a habit, not an ear for fakes: never act on a call you did not initiate when it involves money, codes, or remote access to your computer. Hang up, then call the organisation or person back on a number you already trust. For family emergencies, agree on a code word in advance with elderly relatives, something a scammer cannot guess from public videos, and teach them that any caller demanding secrecy or immediate payment is a red flag, however convincing the voice sounds.

QR-code phishing, sometimes called quishing, is the fastest-growing variant because the destination is hidden inside an image rather than written as text. A QR code on a parking meter sticker, a restaurant table, a poster, or inside a PDF invoice can point anywhere, and your phone's camera will open it without showing you the address first. Only scan QR codes from sources you trust, in places you expect them, and always check the preview address your phone shows before tapping through. If a QR code asks you to log in to a bank, a work system, or an email account, stop: no legitimate login should arrive via a sticker or an unsolicited document. Microsoft's security teams detected more than 145 million QR-code phishing attacks in one reporting period, with most arriving inside PDFs, which is why an unexpected PDF with a prominent QR code deserves the same suspicion as an unexpected link.

Most phishing messages are variations on five stories, and learning them means you will recognise the next one even when the details change. First, the locked account: your bank, email, or social account will be closed unless you verify now. Real services warn you inside their app and give you days, not minutes. Second, the failed delivery: a parcel needs a fee or an address confirmation. Real couriers show tracking in their own app and do not demand payment by text link. Third, the unpaid invoice or subscription renewal: an attached document or a payment link for a service you may actually use, which is why it works. Check the subscription inside the real app before paying anything.

Fourth, the boss or colleague request: an urgent favour, a gift-card purchase, or a change of bank details for a supplier, often sent late in the day when you are least likely to check. Real payment-detail changes are confirmed by phone on a known number, never by email alone. Fifth, the government or tax message: a refund, a fine, or a legal threat from a tax authority or police department. Real authorities write to you formally, do not demand cryptocurrency or gift cards, and do not threaten arrest by text message. If a message fits one of these five stories and arrived unprompted, assume it is phishing until you have verified it through an independent channel.

Clicking a link does not automatically mean you have been compromised. What matters is what happened next, and speed matters more than embarrassment. If you only opened a page and entered nothing, close it, do not download anything it offered, and run a scan with your device's built-in security tool. If you entered a password, go directly to the real service, not through any link, change that password immediately, and change it anywhere else you reused it. Then turn on two-factor authentication, review recent sign-ins and connected devices, and revoke any session or app you do not recognise. If you entered payment details, contact your bank or card provider at once and ask them to block or replace the card; banks deal with this daily and will not judge you for it.

If you shared identity documents, a national ID number, or enough personal details for identity theft, report it to your country's identity-theft or cybercrime authority and put a fraud alert or credit freeze in place where that service exists. If you installed software or gave someone remote access to your computer, disconnect from the internet, uninstall the remote-access tool, run a full malware scan, and have the machine checked professionally if it holds work or financial data. In every case, warn the people around you: forward the message to your IT team or, for a personal account, tell friends and colleagues that a scam is circulating in your name, because the same message is often sent to your contacts next.

Reporting is worth doing even after you have protected yourself, because it is how senders get blocked. In Gmail, open the message, click the three dots, and choose Report phishing. In Outlook, use the Report button and choose Phishing. For texts, forward the message to 7726 where your carrier supports it, and use your phone's report-spam option. For a fake website, most browsers let you report it from the safety menu, and your country's cybercrime reporting service accepts reports from the public. You do not need to be certain before reporting. A report that turns out to be a false alarm costs nothing; a phishing campaign that nobody reports keeps running.

The strongest defence is a setup that makes phishing fail even when you slip. Use a password manager and give every important account a unique password, so one stolen login cannot open everything else. Wherever it is offered, switch from passwords to passkeys, which cannot be typed into a fake page because they only work on the real domain. Turn on two-factor authentication everywhere it matters, and prefer an authenticator app or a hardware security key over SMS codes, which can be intercepted or tricked out of you. Keep a separate email address for banking and government services, and do not use it for newsletters or shopping, so a phishing email to your everyday inbox stands out immediately.

Two more habits cost nothing and help a lot. First, bookmark the sign-in pages for your bank, your email, and your work systems, and always use the bookmark instead of a link from a message. Second, set your devices and browsers to update automatically, because many phishing pages exploit old software rather than clever tricks. None of this makes you immune, and that is the wrong goal. The goal is to make a single mistake survivable: a stolen password that cannot be reused, a code that cannot be phished, and a habit of verifying before acting.

Pause when a message creates urgency, excitement, or fear. Ask what the sender wants you to do, and whether you were expecting it. Never share a password or a verification code with anyone who contacted you first. Never click a link, call a number, or reply inside a suspicious message; verify through the official app, a typed address, or a known number instead. Hover or long-press links to see the real domain, and remember that a padlock does not mean a site is genuine. Treat gift cards, cryptocurrency, and wire transfers as scam payment methods. Report what you receive. And set up passkeys, a password manager, and app-based two-factor authentication today, while you are calm, so that tomorrow's convincing message meets a system that is already prepared for it.

Phishing succeeds because it borrows trust and rushes you past your own judgement. The counter is unglamorous and it works: slow down, verify through a channel the sender does not control, and build an account setup where one click cannot cost you everything. If this guide saves you from a single bad click, it has done its job. Share it with one person who is less technical than you are, because the people scammers target most are rarely the people who read security guides.