Phishing emails
A fake message that persuades you to click, sign in or pay.
Understand it
Phishing is a confidence trick by email. A message poses as your bank, a supplier, a courier or a colleague, and steers you towards a link, a login or a payment. The tools that write them are now very good, so poor spelling is no longer the giveaway it once was.
How to spot it
Unexpected urgency, a link that does not match the real website, a request to “confirm” a login, or any push to act this minute.
Close the gap
- Do not sign in through a link in a message - open the site yourself from a bookmark.
- Turn on two-step sign-in - an app code or a key - wherever it is offered.
- If money is involved, confirm it by phone on a number you already hold.
- When unsure, run the message through the Phishing checker in the Toolkit.
What to do about it
You don't fix a scam, you spot one. Run anything suspicious through our phishing checker, and let your plan harden the accounts and money they're really after. When money's involved, the fix is a habit, not a setting: confirm every payment or change of bank details by phone, on a number you already have.