TL;DR

What it is

Phishing is any message — email, text message, phone call, WhatsApp, even a QR code — that pretends to be from someone or something you trust, in order to get you to do something you wouldn't otherwise do.

The "something" is usually one of these:

It is called phishing because the attacker is throwing a hook into a vast pond. They don't know if you will bite. They only need a small fraction of recipients to fall for it, and the email cost them nothing to send.

A few names you may hear:

The technique is the same. Only the channel changes.

How to spot it

Old advice told you to look for spelling mistakes and weird grammar. That advice is now out of date — AI can write a flawless email in any language in two seconds. You have to look at what the message is asking you to do, not how nicely it asks.

The pattern is almost always some version of three things together: urgency, authority, an action.

  1. Urgency. "Your account will be closed in 24 hours." "Your package will be returned." "Suspicious login detected — confirm now." Real institutions almost never give you a one-hour or one-day deadline by email. They send a letter. They call you back through their normal app. They wait.
  2. Authority. The message looks like it's from your bank, your tax office, your government, a major delivery company, a streaming service, your employer's IT team, your CEO. The familiar logo, the right colours, the right tone. Anyone can copy a logo.
  3. The action. Click this link. Confirm this code. Reply with this document. Pay this small fee to release the parcel. This is the part that lets you stop the attack. Whatever the message is, ask: if I do nothing, what actually happens? The honest answer is almost always "nothing bad."

Other tells worth knowing:

What to do

If you haven't acted yet:

  1. Stop. Don't click. Don't reply. Don't call any number printed in the message.
  2. Verify through a separate channel. If "your bank" emails you, open your bank app or the website you usually use — by typing the address yourself, not from the email — and check there. If "the tax office" calls, hang up and call back on the official number from their public website. If "your boss" texts an urgent request, walk over or phone them on the number you already have.
  3. Report the message and delete it. Most email clients (Gmail, Outlook, Apple Mail, ProtonMail) have a "report phishing" button. Use it. SMS in many countries can be forwarded to 7726 (the digits spell SPAM) to be analysed by your carrier. Then delete the original.
  4. Tell the family. If your parents, partner, or children share an email surname or a household address, they will probably get the same campaign within the day. A two-line "watch out for this one" message at home stops more harm than any filter.

If you already clicked or typed your password — the next thirty minutes are what counts. Stay calm. Work through this list in order.

  1. From a different device (not the one you clicked from, if you can avoid it) — change the password of the account whose password you just entered. Use a strong unique one.
  2. Turn on two-factor authentication on that account if it isn't already on.
  3. Sign out of every other session. Most major accounts (Google, Microsoft, Apple, Facebook, your bank) have a "sign me out of all devices" button buried in security settings. Press it.
  4. Check the account's recent activity. Login locations, recent emails sent, payment methods added, forwarding rules set up. Phishers often set up an inbox rule to hide their tracks — delete any rule you didn't create.
  5. If you typed banking details — call your bank's official number now. Card freeze, password reset, transaction review. The bank cares more about a five-minute warning than a five-day-old surprise.
  6. If you typed an ID document or personal data — see the Identity Theft Recovery topic; the response is different and slower.
  7. Disconnect the device from the internet if you opened an attachment or downloaded something. Run your operating system's built-in security scan. If anything looks wrong afterwards, treat the device as compromised and seek help.
  8. Warn the people in your contacts. A compromised email account is often used to phish the people who trust you. A short heads-up message — sent through a different channel like WhatsApp or text — prevents the second wave.

What NOT to do

Use AI to help you

Two prompts you can copy. Paste the suspicious message in full — including the headers if you can — and let the AI walk you through it. Don't paste passwords or two-factor codes.

Is this message phishing?

"I received the message below. I'm not sure if it's a phishing attempt. Please analyse it from the perspective of an experienced security professional and tell me: (a) what red flags you see, (b) what the sender's domain actually looks like and how it differs from the real organisation, (c) what specifically the message is asking me to do, and (d) on a scale of 1–10, how likely this is to be a phishing attempt, with your reasoning. If I should do something now, list the first three steps in order.

Message: [paste here]"

I already clicked — what now?

"I clicked a link in what I now believe was a phishing email. On the page I clicked, I entered [my email and password / my credit card number / my ID document / a two-factor code]. Please build me a calm step-by-step recovery plan for the next 30 minutes, in order of priority. Then tell me what I should monitor for the next two weeks."

A reminder: AI can be confidently wrong about the legality, contact numbers, or recovery rights in your specific country. Use the AI to think with, not to replace a quick verification with the real bank or authority.

Who to call

The order is almost always the same:

  1. Your bank — if money or card details are involved. The official number on the back of your card or in your bank's app, never the one in the message.
  2. The real organisation being impersonated. Find their official contact page yourself and report the phishing — they keep records and use them to take down fake sites.
  3. The platform the message came from (email provider, SMS carrier, messenger). Most have a one-click "report phishing" or "report scam" feature.
  4. Your country's anti-fraud authority.

Find the latest for your country with AI:

"I'm in [your country]. List the official government and law-enforcement bodies I should report a phishing attempt or online fraud to — anti-fraud authority, national cybersecurity centre, police cybercrime unit, banking ombudsman, telecom anti-spam SMS short-code if any. For each, give the official website URL and public phone number, and tell me which to contact first depending on whether (a) money has moved, (b) only a password was given, or (c) an ID document was given. Cite the official source page for each. If anything might be outdated, say so."

A short list, by language and country (curated — prefer the AI prompt above for the very latest):

If your country isn't listed, use the AI prompt above, or search for "[your country] national cybersecurity centre" or "[your country] anti-fraud reporting". Most have a single official portal.

When to escalate beyond chat

Related topics

Sources & references (internal — not rendered to the live page):