To take action : 5–10 min · Depending on your devices and accounts
You received a weird email from your bank?
Verify a convincing request through another channel.
PatchYourself · Last editorial revision : · Sources
Fictional example: an everyday situation
A message tells Max that a delivery needs a small extra payment. Instead of opening the link, he checks his account directly with the carrier. There is no matching request.
The problem
Phishing tries to make you reveal a secret, pay or install software by pretending to be a trusted contact. It can arrive through email, text, messaging, calls or QR codes.
Correct spelling, a logo, a familiar name or a recognizable voice do not authenticate a request. Even a real account can be compromised.
What to do now
Step 1: Pause at unusual requests
A short deadline, closure threat, change of bank details or request for a code calls for verification. The message may be perfectly written and use real context.
Step 2: Open the service yourself
Use your app, a known bookmark or usual address. For a call, hang up and contact the person using a number found independently. Do not reuse contact details supplied by the suspicious message.
Step 3: Check the destination
Look at the full domain before signing in. An email sender’s display name can be forged. HTTPS encrypts the connection but does not prove the site belongs to the expected company.
A password manager that does not offer your usual sign-in can draw attention to a different domain. This is an aid, not universal proof.
Step 4: Report and respond to what happened
Use your email service’s reporting option. If you entered a password, supplied a code, paid or installed a file, open the emergency guide. Clicking without entering data or installing anything does not automatically mean an account was stolen: check what actually happened.
Go further
Targeted attacks
Spear phishing adapts a message to a person or organization. Public information can make a request credible. A separate known channel remains useful even when details appear accurate.
Practice
Take a fictional message and identify what it requests: payment, sign-in, a code or an installation. Decide how to verify it without using its links. The goal is a repeatable process, not recognizing every spelling mistake or fake logo.
Sources and verification
References used for this revision. Menus and offers can change; consult the provider’s help for your version.