What is phishing, and how do I spot it?

Phishing is a scam where an attacker sends a message, email, text, or even a phone call, pretending to be a trusted entity, your bank, a delivery service, a boss, a familiar company, to trick you into handing over passwords, credit card numbers, or money, or into clicking a link that installs malware. It is the single most common way accounts get hacked and one of the most effective, because it targets human trust rather than technical defenses, and modern phishing is far slicker than the old typo-ridden prince emails, with convincing logos, real-looking sender names, and AI now making the writing flawless.

The reliable warning signs are worth memorizing. Urgency and fear, your account will be closed, suspicious activity detected, act now, are designed to make you react before you think. Unexpected requests to click a link, verify your details, or make a payment deserve deep suspicion. Check the sender's actual email address, not just the display name, since scammers use lookalikes (support@paypa1.com instead of paypal.com), and hover over links to see where they really lead before clicking. Legitimate companies do not ask for passwords or full card numbers by email or text. The golden rule when anything feels off: do not click the link in the message. Instead, go to the company directly, type its address yourself or use the official app, and check. And enable two-factor authentication, so that even a password stolen by phishing is not enough to get in.