Safe Wave Blog
Internet Security

How to spot a phishing message in ten seconds

Phishing has got better at looking real. The tells haven't changed much, and checking them takes less time than reading the message.

6 min read

Smartphone on a wooden table showing a bank alert notification

Most phishing doesn't try to break into your device. It tries to get you to hand over a password, a card number or a one-time code yourself. That's why it works on careful people, and why a few quick checks catch most of it.

The ten-second check

  1. Is it pushing urgency? "Your account will be closed today", "unusual sign-in, act now", "parcel held, pay within 24 hours". Pressure is the point: it's there to stop you checking.
  2. Who actually sent it? Look at the full sender address, not the display name. A bank doesn't write from a free mail account or a domain with extra words bolted on.
  3. Where does the link really go? On a computer, hover over it. On a phone, press and hold to preview. If the domain isn't the company's real one, stop.
  4. What is it asking for? Passwords, verification codes, card details, gift cards or remote access to your device. Legitimate companies don't ask for these by message.

Text messages are the same trick

Smishing (phishing by SMS) leans on delivery notices, toll fines and bank alerts, because those are messages people expect. Short links hide the destination, and the page behind them is often a convincing copy of the real one. The check is the same: don't tap, go to the company's site or app yourself.

The rule that beats every trick: never act from the link. Close the message, open the app or type the address you already know, and check there. If the problem is real, it will be waiting for you.

Signs that matter less than people think

Spelling mistakes used to be the giveaway. Many phishing messages are now well written and use real logos. A padlock in the address bar only means the connection is encrypted; scam sites have padlocks too. Judge by the sender, the destination and the request, not by how polished it looks.

If you already clicked

  • If you entered a password, change it now, and anywhere else you've used the same one.
  • Turn on two-step verification for that account if it isn't already.
  • If you shared card or bank details, call your bank using the number on your card.
  • If you installed something or granted remote access, disconnect from the internet and run a full security scan.

Then report the message, to your email provider and to the company being impersonated. It takes a minute and helps get the page taken down.