How to Spot and Avoid Phishing Scams by Email, Text and Phone

This guide is for anyone who has ever paused over a message and wondered whether it was real. You will learn how phishing scams work across email, text messages and phone calls, the warning signs that give them away, a simple routine for checking any suspicious contact, and what to do quickly if you think you have been caught out. General information, not professional advice.

What Phishing Is and Why It Works

Phishing is when a criminal pretends to be someone you trust, such as your bank, a delivery company, a government office, your employer or even a family member, to trick you into handing over money, passwords, card details or access to your devices. When it happens by text message it is often called smishing; by phone call, vishing. The methods change but the goal is always the same: get you to act before you think.

Phishing works not because people are foolish but because the messages are designed around normal human reactions. They create a sense of urgency (your account will be closed today), fear (a suspicious payment was made), reward (you have won a prize or are owed a refund) or helpfulness (a colleague needs a quick favour). Clever scammers time their messages to match real events, such as tax season, holiday shopping or a known data breach.

Scams are also becoming more polished. Spelling mistakes used to be a reliable giveaway, but criminals now use AI tools to write fluent messages and can even imitate voices. That means you cannot rely on how a message looks. You need a habit of checking through a separate route, which this guide will teach you.

Warning Signs in Emails

Email is still the most common route for phishing. Look at each of the following before you click anything. One sign on its own is not proof, but two or more should make you stop.

• The sender's address does not match. The display name may say your bank, but the actual address is a random string or a lookalike domain, such as an extra letter, a swapped character, or a different ending.
• A generic greeting like "Dear customer" from a company that normally uses your name.
• Pressure and deadlines: act within 24 hours, final warning, account suspended.
• Requests for sensitive information such as passwords, full card numbers, PINs or one-time codes. Legitimate organisations do not ask for these by email.
• Links that go somewhere unexpected. On a computer, hover over a link without clicking to see the real web address. On a phone, press and hold to preview it.
• Unexpected attachments, especially invoices, zip files or documents asking you to "enable content".
• Payment changes: a supplier, landlord or colleague suddenly sends new bank details.

When reading a web address, focus on the part just before the first single slash. In an address such as yourbank.secure-login.example.com, the real site is example.com, not your bank. Scammers rely on people seeing a familiar word somewhere in the address and assuming it is fine.

Be just as careful with QR codes in emails, letters, parking machines and posters. A QR code is simply a link you cannot read before you scan it. Criminals stick fake codes over real ones on car park signs and send letters with codes that lead to fake payment pages. After scanning, look closely at the web address your phone shows before you open it, and if you are paying for something, use the official app or a website you type in yourself.

Phishing also arrives through social media and messaging apps. Watch for direct messages from accounts claiming to be customer support, friends whose accounts have been taken over asking you to vote in a contest or share a code, and adverts for deals that seem too good to be true. Real companies rarely contact you first through a private message, and they never need your password to help you.