How to Recognize and Avoid Phishing
Recognize phishing messages, verify requests through trusted channels, avoid fake sign-in pages, and act quickly if you share sensitive information.
Pause when a message creates urgency
Phishing messages try to make you reveal information, send money, or install something harmful. They may claim that an account is locked, a payment failed, or a document needs immediate review. Familiar logos and polished writing do not prove that a message is genuine. Treat unexpected requests for passwords, verification codes, identity documents, or payments as a reason to stop and verify.
Verify outside the message
Open the organization's app yourself or use a bookmark you already trust. For a phone call, use a number from an official statement or a website you reached independently. Do not rely on contact details supplied in the suspicious message. If the request appears to come from a coworker or relative, confirm through an established contact method before sharing documents or changing payment details.
Check the destination before signing in
A sender name can be copied, and a link can lead somewhere different from its visible text. Check the actual website address carefully. A padlock indicates an encrypted connection, not an honest business. Avoid signing in through unexpected links. A password manager may help by refusing to autofill on an unrelated domain, but that is not a substitute for checking the request yourself.
Respond based on what you shared
If you entered a password, change it through the real service and replace it anywhere else you reused it. Review active sessions and account recovery settings. If you shared a verification code, contact the service promptly. If you sent financial information, contact the relevant institution. Report the message through your mail provider or workplace process, then delete it. Preserve evidence if fraud has occurred.