Phishing is a message that pretends to come from someone you trust, such as a bank, a delivery company, your employer or a friend, so that you will click a link, open a file or hand over a password. It arrives by email, text, messaging apps and phone calls. The messages are often convincing, but they share a few habits.
What does a phishing message usually want?
Nearly every phishing message wants one of three things. It wants you to sign in on a page the sender controls, to open an attachment that installs something harmful, or to send money or information because of a made-up problem. The story around the request changes, but the goal stays the same.
Common stories include a locked account, a missed delivery, an unpaid invoice, a refund you did not expect, a prize, or a relative who is in trouble and needs help right away. Treat any message that asks for a password, a verification code, a payment or a copy of an ID document as something to verify before you act.
Which signs give a phishing message away?
No single sign proves a message is fake, and good fakes can avoid all of them. Still, these are worth checking each time:
Pressure. The message says you have a few hours, that your account will be closed or that something bad will happen if you wait.
A sender address that is close but wrong, such as a swapped letter or an extra word in the domain.
A link whose visible text does not match where it goes. On a computer you can hover over it, and on a phone you can press and hold it to see the address.
An unexpected attachment, especially a zip file, an invoice you did not request or a file that asks you to enable macros.
A request to pay in gift cards, cryptocurrency or a bank transfer to a new account.
What should you do before you click?
Stop and slow down. Pressure is the tool the sender depends on, so taking a few minutes removes much of their advantage. Do not reply, do not call a number in the message and do not open the link or attachment.
Then check the claim through a route you already trust. Open the company’s app or type its address into the browser yourself, and look for the same notice in your account. Call the number printed on your card or on the company’s official website. If the message seems to come from a colleague or relative, contact them in a different way, such as a phone call, and ask whether they sent it.
Why are texts and calls part of phishing too?
Phishing is not limited to email. Text messages about parcels, tolls or bank alerts are common, and so are calls from someone who says they work for your bank or a support team. A caller can make the number on your screen look like almost anything, so the displayed number proves nothing.
A real bank will not ask you to move money to a “safe account”, and a real support team will not ask for a code that was just sent to your phone. If a caller creates urgency, hang up and call back using a number you found yourself. The same applies to voice messages and to messages from a friend’s hacked account asking for money.
What if you already clicked or entered a password?
It happens to careful people, and acting quickly makes a real difference. Work through these steps in order:
Disconnect from the problem. If you opened a file and think it ran something, turn off the network connection on that device and keep it off until it has been checked.
Change the password for the account involved, using a different device if you can. If you reused that password anywhere else, change it there too.
Turn on two-step verification, preferably with a passkey or an authenticator app, and sign out of other sessions in the account settings.
Contact your bank right away if you shared card or banking details. Ask them to block the card or watch for unusual activity.
Look for changes you did not make, such as new forwarding rules in your email, new recovery addresses or unfamiliar sign-ins.
Report the message to the service it pretended to be, and tell your contacts if the account sent messages in your name.
How can you make phishing less harmful in the first place?
You cannot stop every message from reaching you, so the aim is to limit the damage when one gets through. Use a different password for every account, and keep them in a password manager, which also helps because it will not fill a password on a site with the wrong address. Passkeys go further, since they cannot be typed into a fake page at all.
Keep your phone and apps updated, and be careful with apps and files from outside the official stores. Limit what is kept in places that a single stolen password can open. Copies of your passport, tax papers or contracts do not need to sit in your email inbox, where one successful phishing message could expose all of them.
This is one place where Revault can help. It keeps photos, documents and files in an encrypted vault on your device, with no Revault account to be phished. That does not stop a fake message from being sent to you, but it keeps your most sensitive files out of your inbox and cloud accounts. No tool replaces judgment, so the habit that protects you most is the simple one: when a message asks for something urgent, verify it another way first.