Phishing is still one of the most common ways criminals get into personal and work accounts. The attack usually looks ordinary: an email that seems to come from a bank, a delivery firm, a colleague or a government agency, a text asking you to confirm a payment, or a call from someone claiming to be from IT. The goal is the same in each case, to get you to hand over a password, a login code or a payment.
This guide explains the warning signs that CISA and other security agencies highlight, what criminals tend to exploit, and the steps that make an account much harder to take over. It does not cover every scam type, but the same habits apply across most of them.
What a phishing attack is
Phishing is a form of social engineering. According to CISA, phishing attacks use email or malicious websites to ask for personal information by posing as a trustworthy organisation. The request often suggests there is a problem, such as a locked account or an unpaid invoice, so that the victim responds quickly without checking.
The same method is used over other channels. CISA describes vishing, which uses voice calls, and smishing, which uses text messages. Text messages can contain links that open a browser or a phone number, which makes it easier for a fake message to look genuine.
Warning signs to check first
CISA lists several indicators that a message may be a phishing attempt. The most useful to check are:
- A sender address that imitates a real business. Criminals often use a domain that is close to the real one, with one letter changed or an extra word added.
- Urgency or threats. Messages that say an account will be closed or a payment is overdue within hours are designed to stop you thinking.
- Requests for passwords, codes or payment details. A legitimate organisation rarely needs you to type these into a message.
- Links that do not match the sender. Hover over a link on a computer, or press and hold it on a phone, to see where it goes before you tap.
- Unexpected attachments. Files you did not ask for can carry malware or lead to a fake login page.
CISA also notes that attackers take advantage of current events, holidays, economic worries and elections. A message that uses a news story or a seasonal deadline should be checked as carefully as any other unexpected request.
Why a password alone is not enough
Many phishing attacks aim to capture a password and a one-time code at the same time. Google’s account security guidance recommends stronger second steps for this reason. It advises security keys as the most secure verification method, followed by Google prompts, and says text message codes are vulnerable to common phishing techniques.
Passkeys are a stronger option still. Google explains that passkeys cannot be shared, copied, written down or accidentally given to someone else, which makes them more resistant to phishing. You sign in with a fingerprint, face scan or device screen lock instead of typing a password into a page that might be fake.
Steps to take now
- Run a security check on your main accounts. Google’s Security Checkup, and the equivalent in other services, lists recommended changes.
- Turn on two-step verification, and use a security key or app prompt where the service offers it rather than text codes.
- Set up recovery options, such as a backup email address, so you can regain access if an account is taken over.
- Do not sign in through links in an unexpected message. Open the official app or type the address yourself instead.
- Check your app access. Remove apps you no longer use, because they can keep access to your account data.
What to do if you clicked or entered details
If you entered a password, act straight away. Change the password on the real site, not through the message, and change it anywhere else you used the same one. Sign out other sessions if the service allows it, and turn on stronger verification.
If you sent payment details or money, contact your bank or card provider immediately. Report the message to the organisation it claimed to come from and to the reporting service in your country. In the UK, the National Cyber Security Centre publishes guidance on suspicious messages and what to do after an incident.
For small businesses
Businesses face the same tactics, often with larger losses. The US National Institute of Standards and Technology publishes guidance for small businesses on basic cyber protection, including staff training and account controls. For a team, the most effective measures are multi-factor authentication on email and finance systems, a rule that payment changes are confirmed by phone, and regular short reminders about current scams.
Phishing is one of several everyday security risks. Our guides on Is This Website Safe? 8 Best Checks That Take Under 2 Minutes, What Is a VPN? 7 Best Facts on How It Works and When You Need One, AI for Small Business: The Complete Guide for 2026 and Free Up Android Storage: 9 Best Ways to Fix Storage Full for Good cover related steps for keeping accounts and devices safer.
Frequently asked questions
What is the most common sign of a phishing email?
A sender address that looks like a real company but is slightly wrong, combined with a request to act urgently or enter login details, is a pattern CISA flags as a warning sign.
Are text message codes safe for two-step verification?
They are better than no second step, but Google advises stronger options such as security keys or Google prompts because text codes are vulnerable to common phishing techniques.
What is a passkey?
A passkey lets you sign in with your fingerprint, face scan or device screen lock. Google says passkeys cannot be shared or copied, which makes them harder to phish than a typed password.
Should I reply to a suspicious message to check if it is real?
No. Replying confirms that your address is active and can invite further attacks. Contact the organisation through a phone number or website you already trust.
What should I do if I think my account has been compromised?
Change the password on the official site, turn on stronger verification, sign out other sessions, and check your recovery options. If money or banking details are involved, contact your bank straight away.
Sources
- CISA: Avoiding Social Engineering and Phishing Attacks
- CISA: Cybersecurity Best Practices
- Google Account Help: Make your account more secure
- UK National Cyber Security Centre: Phishing attacks
- NIST: Small Business Cybersecurity Corner
