A phishing message tries to turn urgency, curiosity, or fear into a click, a payment, or the disclosure of information. The first useful action is to pause. A familiar logo, display name, or convincing subject line is not enough to prove who sent a message.
Mistake: checking the message by replying to it
If a notice claims an account is locked or a bill is overdue, open the organization's known app or type its verified address yourself. Do not use the phone number or link supplied in the suspicious message. The FTC's phishing guidance recommends contacting the organization independently. A genuine problem will still be visible in the legitimate account or through a known support channel.
Mistake: trusting urgency as evidence
Scams often ask for a quick click, an attachment download, or a verification code. CISA's phishing tip sheet advises using an independent contact route when a message seems suspicious. Check what action the message asks for, not just whether its grammar looks polished. A message can be suspicious even when its spelling is perfect.
If you already interacted
If you entered a password, change it through the real service from a trusted device, review account sessions, and enable a stronger second factor if available. If you downloaded a file, stop opening it and use your device's security tools. If money or personal information was involved, use the relevant bank or identity-recovery channel promptly. The response depends on what you shared; a generic "delete the email" instruction is not enough.
Close the loop
Use the mail service's phishing-report control, then remove the message from your normal view. Tell others only what they need to avoid the same lure, without forwarding a live malicious link. The better habit is a repeatable verification route, not memorizing a list of visual tells that scammers can imitate.
Sources
- How To Recognize and Avoid Phishing Scams — Federal Trade Commission
- Secure Our World Phishing Tip Sheet — CISA