Phishing basics: how to spot a fake message
The common signs CISA lists, and what to do instead of clicking.
What phishing is
CISA says phishing is when criminals try to get you to open harmful links, emails, or attachments that could request personal information or infect your devices. It says it can arrive by email, text, social media message, or phone call.
The signs CISA lists
CISA lists urgent or emotional language, requests for personal and financial information, untrusted shortened links, and incorrect email addresses or links.
Spelling is no longer a sign
CISA says poor grammar used to be a common sign, but with AI some phishing emails now have perfect grammar and spelling.
What to do
CISA says not to click any link or call any number in a suspicious message. It says to find the company's contact details on its verified website instead.
Check the sender
Microsoft says to look at the sender's address: if a message claims to be from your bank but the address is not your bank's domain, treat it as a warning.
Report it
CISA says to report the phish, often with a report option near the sender's name or a report spam button, then delete the message.
This is general information, not security or technical support advice.
Sources: CISA, Recognize and Report Phishing (archived); Microsoft Support, Protect yourself from online scams and attacks.
FAQ
Next: fake virus warnings
Scary pop-ups and phone numbers.
