What phishing is
Phishing is a trick in which someone sends a message pretending to come from a trustworthy source, such as a bank, a course provider, a school, a delivery company or a colleague, in order to get you to reveal a password, send money, open a harmful attachment or visit a fake website. The name suggests casting a line in the hope that someone bites.
Many phishing messages are mass-mailed and generic. Others, sometimes called spear phishing, are written for a particular person or organization and can be much more convincing. Similar tricks arrive by text message, phone call, social media and messaging apps, and the same principles apply to them.
Common warning signs
No single sign proves a message is fake, and some genuine messages have clumsy wording. What matters is the combination.
Pressure and urgency. Phrases such as “act now”, “your account will be closed in 24 hours” or “final warning” are designed to stop you thinking. Legitimate organizations do sometimes set deadlines, but they rarely threaten consequences by email without other ways to verify.
An unexpected request. Be careful with any message asking you to confirm a password, enter a security code, update payment details, or “verify your identity”, especially if you were not expecting it. Genuine services generally do not ask for your password by email.
A sender address that does not quite match. The display name may say a familiar organization while the actual address belongs to somewhere else, or is a lookalike with a small change in spelling. Checking the address, not just the name, is worthwhile. Be aware, though, that addresses can be faked, so a plausible-looking one is not proof.
Links that go somewhere else. On a computer, hovering over a link usually reveals its real destination. If the visible text says one thing and the destination is another, or the address looks like a jumble of unrelated words, do not click. On a phone you can often press and hold a link to preview it.
Generic greetings. “Dear customer” or “Dear user” from an organization that should know your name can be a clue, although better-targeted attacks will use your name.
Unexpected attachments. Invoices, “scanned documents” and “voicemail” files that you were not expecting can contain harmful software. Be particularly careful with files that ask you to enable macros or run a program.
Too good to be true. Prizes, refunds, scholarships or job offers that arrive unprompted and need a fee or personal details are classic bait.
Poor presentation. Odd spelling, strange formatting or a mismatched logo can be a sign, but do not rely on it. Modern fakes can look polished, and tools that generate text have made well-written scam messages more common.
What learners often see
Students receive a lot of administrative email, which gives scammers plenty of material. Typical themes include a message that a course account has been suspended, a notice that a certificate or grade is ready to view, a request to re-enter login details for a learning portal, an offer of paid work, or a tuition or fee reminder. If a message claims to come from your school or an online platform you use, check it through the official route rather than the message itself.
What to do when a suspicious message arrives
- Pause. Do not click, reply or open attachments straight away.
- Check independently. Open the website by typing its address or using a bookmark you saved earlier, and sign in there to see if any real notice exists. Or contact the organization using contact details you already trust, not those in the message.
- Do not forward it widely. Report it where there is a proper channel, for example your institution’s IT or security team, or the reporting address that your email provider or national cyber security agency publishes.
- Delete it once reported, and consider blocking the sender.
Mark messages as spam or phishing in your email program if the option exists, since this helps filters improve.
If you already clicked or replied
It happens, and prompt action limits the damage.
- If you entered a password, change it at once on the genuine site, and on any other account that uses the same password. Turning on two-factor authentication adds a further barrier.
- If you opened an attachment or installed something, disconnect from the network if you can, run a security scan with software you trust, and ask your IT support for help.
- If you shared payment details or sent money, contact your bank or card provider immediately and report the scam to the relevant authority in your country.
- Tell the organization that was impersonated, as other people may be receiving the same message.
Do not feel embarrassed. Phishing is a widespread crime, and experienced people are caught too.
Making yourself harder to fool
Slowing down is the best single defense. Habits that help include using a password manager, which will not usually fill in a password on a fake site because the address does not match; keeping devices updated; and being cautious about how much personal detail you post publicly, since attackers use it to make messages believable. Developing general information literacy also helps you question a message before accepting it. No measure is foolproof, but a pause and an independent check defeat most attempts.