How to Spot a Phishing Message in Ten Seconds

By Dana Okafor · Published Sep 1, 2026 · 6 min read

In this guide

The pressure test
Never use the link — go direct
Check the sender properly
Red flags worth memorising
If you already clicked

Phishing messages used to be easy to spot: broken English, obvious fake logos, a prince who needed your help. Today they are often polished, personalised, and timed to arrive when you are expecting a delivery or a bill.

You do not need to become an expert to beat them. You need a few habits that work regardless of how good the fake looks.

The pressure test

Almost every scam tries to make you act before you think: your account will be closed today, a parcel will be returned, a payment has failed, someone has logged into your account. Urgency is the tell. Legitimate companies rarely need you to act within the hour.

When a message makes your pulse rise, that is exactly the moment to slow down.

Never use the link — go direct

The single most effective habit: do not click links in unexpected messages about your accounts. Instead, open the app or type the website address yourself and check there. If there really is a problem with your account, you will see it when you log in normally.

This works even against perfect fakes, because it never relies on you spotting the difference.

Check the sender properly

Display names are easy to fake. Tap or hover on the sender to see the real address. Look for misspellings, extra words, or odd domains ("amaz0n-support.co" rather than "amazon.com"). For texts, messages from ordinary mobile numbers claiming to be your bank or a delivery firm are a strong warning sign.

Red flags worth memorising

Any one of these should make you stop and verify through a separate channel:

A request to pay with gift cards, cryptocurrency, or a wire transfer
A request for a verification code that was just texted to you — never share these
An attachment you were not expecting, especially a zipped file or a document asking you to "enable content"
A "boss" or "family member" asking for money or urgent favours from a new number
A QR code in an email or on a parking meter sticker leading to a payment page

If you already clicked

Do not panic, but act quickly. If you entered a password, change it immediately on the real site and anywhere else you use it, and turn on two-factor authentication. If you entered card details, call your bank using the number on the back of your card. If you downloaded something, run a full security scan. Then report the message — most email and phone providers have a "report phishing" option.

This is general technology information for home users, not professional IT or security advice. Menus and features change between software versions — check your device maker's official help pages for the current steps.

🔓

Keep reading

Watch a short ad to unlock the rest of this guide — free, no account needed.