Email and SMS phishing: how to spot it and what to do

Phishing is the art of pretending to be someone you trust so that you hand over something valuable: a password, a card number, a copy of your ID. It arrives by email, by text message (where it is called smishing), or through chat apps. The message changes, but the goal never does, and neither does the trigger it pulls.

It runs on urgency, not persuasion

A phishing message does not need to convince you. It only needs to rush you. A parcel is stuck, an account is suspended, a fine is due tonight, a refund is waiting. The clock is the weapon. When you feel you have to act this second, the careful checks you would normally make quietly disappear.

On top of the pressure sits imitation. Logos, colours, an official tone, a sender name that looks right. Some copies are clumsy. Others are polished enough to fool careful people on a busy day.

What to look for

No single clue proves a scam, but together they tell a clear story.

• Urgency or a threat: a blocked account, a closing case, a penalty.
• A request for sensitive data: password, security code, card number, IBAN.
• A link whose real address does not match the organisation it claims to be from.
• A sender address that is subtly misspelled, or hidden behind a friendly display name.
• Odd details: clumsy phrasing, generic greetings, a layout that is almost but not quite right.

When you are unsure, paste the message into our phishing analyser for a quick risk read, or drop a suspect link into the URL checker before you ever tap it.

The disguises change, the trick does not

Phishing dresses up in whatever pretext is working that week. Fake delivery notices spike around the holidays. Fake tax and fine notices appear near filing deadlines. Fake bank alerts ride on real anxiety about fraud. The decor shifts; the underlying ask is always the same.

If you clicked

Take a breath. The link by itself is usually not the problem.

1. If you entered card details, contact your bank right away and freeze the card.
2. If you typed a password, change it from a device you trust, and turn on two-factor authentication.
3. Watch your accounts and statements over the following days for anything unexpected.

A reputable security suite with anti-phishing protection, such as Bitdefender, can also block many fraudulent pages before they ever load, on both phone and computer.

Where to report

Reporting is quick and it protects the next person in line. Forward the message to your national reporting service, then delete it. In the UK that is Action Fraud; in the US, the FTC. Many scams that begin as a text quickly turn into a phone call from a fake "bank security" team, so it is worth knowing the tactics behind banking scams too, and how phone scams try to finish what the message started.

The thread running through all of it is simple. Trusted organisations do not rush you, and they do not ask for codes or passwords by message. When something insists you act now, that insistence is the warning.