Spotting phishing and scams

Why it matters

Phishing is a message that pretends to come from someone you trust so that you click a link, open an attachment, hand over a password or code, or send money. It is one of the most common ways attackers get into organisations, because it targets people rather than software. Technical staff are prime targets: their accounts can reach source code, cloud consoles, lab systems and payroll.

Phishing arrives as email, text (smishing), phone calls (vishing), chat messages, social media and even QR codes.

The core idea: pressure plus a request

Almost every scam combines two things: pressure that stops you thinking, and a request to act now. If a message creates strong emotion (fear, excitement, urgency) and asks you to do something with credentials, money or files, slow down.

Five signs of a phishing message

1. Urgency or threats

"Your account will be closed in 24 hours." "Unusual sign-in detected, verify now." "Your parcel is held, pay the fee today." Real organisations rarely demand instant action through a link.

2. A sender that does not match

The display name says "IT Support" but the address is it-support@helpdesk-securemail.net. Look at the actual address and domain. Watch for lookalikes: rn posing as m (rnicrosoft.com), 0 for o, extra words (amazon-account-verify.com). A message can also come from a real but compromised account, so a familiar sender is not proof on its own.

3. Links that go somewhere else

The link text says https://yourbank.com but points somewhere different. On a computer, hover over the link (do not click) and read the real address that appears, usually at the bottom of the window. On a phone, press and hold to preview. Read the domain from right to left: in yourbank.com.secure-login.io/account, the real domain is secure-login.io, not your bank.

4. Requests for credentials, codes, payment or secrecy

Asking you to "confirm your password", read back a 2FA code, buy gift cards, change bank details for an invoice, or "keep this between us" are classic signs. Legitimate services do not ask for your password or codes by email, text or phone.

5. Unexpected attachments or too-good offers

An invoice you were not expecting, a "shared document" that asks you to sign in to view it, a .zip, .html, or Office file that asks you to "enable content" or macros. Or a prize, refund or job offer that seems too good to be true.

Spelling mistakes and odd greetings ("Dear Customer") are also clues, but modern scams, often written with AI tools, can be perfectly polished. Do not rely on bad grammar to protect you.

Worked example

You receive this email:

From: Microsoft 365 Admin <no-reply@m365-security-alerts.com>
Subject: ACTION REQUIRED: Mailbox storage full - messages will be deleted

Your mailbox has reached its limit. Incoming mail will be deleted in 2 hours.
Click below to sign in and keep your messages.

[ Keep My Messages ]   (link: https://m365-security-alerts.com/login)

Checklist:

1. Urgency: deleted "in 2 hours". Yes.
2. Sender: m365-security-alerts.com is not a Microsoft domain or your organisation's domain. Yes.
3. Link: the button goes to the same lookalike domain. Yes.
4. Request: sign in, which means hand over your password. Yes.

Four of five signs. Do not click. If you are worried about your mailbox, open your mail the usual way (a bookmark or typing the address) and check there.

What to do

• Do not click, reply, or open attachments. Do not scan the QR code.
• Verify through a separate channel. Type the organisation's address yourself, use its official app, or phone a number you already know. Never use the contact details in the suspicious message.
• Report it. At work, use the "Report phishing" button or tell your IT or security team; that is their job and they want to know. In the US you can report to the FTC at reportfraud.ftc.gov and forward scam texts to 7726 (SPAM); other countries have their own reporting services.
• If you already clicked or entered details: tell IT straight away, change the password from a trusted device (and anywhere you reused it), check that 2FA is still on, and contact your bank if payment details were involved. Reporting quickly limits the damage. Nobody good at security will blame you for reporting.

Common mistakes

• Trusting a message because it uses the right logo or your name.
• Assuming phone calls and texts are safer than email.
• Using the phone number or link in the message to "verify" it.
• Staying quiet after clicking because you are embarrassed.
• Thinking a padlock on the page means the site is legitimate.

Quick recap

• Phishing = pressure + a request for credentials, codes, money or files.
• Check five signs: urgency, sender mismatch, misleading links, sensitive requests, unexpected attachments or offers.
• Verify through a separate, trusted channel.
• Report it, and if you clicked, report fast.

Try it

Open the Do tab and take the quiz to practise spotting the signs.