How phishing works across email, text, phone and QR codes — how to recognise it, and what to do in the first hour if you have already replied.
13 guides
Phishing is any attempt to trick you into handing over a credential, a payment or access by pretending to be someone you trust. The pretext changes constantly; the underlying request almost never does.
Almost every link check comes down to one skill - finding the real domain in a URL. It is the part immediately before the first single slash, and everything to the left of it can say anything at all.
A real CAPTCHA asks you to pick out traffic lights. A fake one asks you to press Windows and R and paste something. That second instruction is the entire attack, and the FTC issued a consumer alert about it in June 2026.
Some attacks never ask for a password at all. Instead you are shown a real Google or Microsoft permission screen and asked to approve an app - and once you press Allow, the access continues after you change your password.
Change the password on that account first, then sign out every device. That second step is the one people miss, and it is the one that actually removes the attacker. Here is the full order, and what changes if you also gave a code.
A QR code is a link you cannot read. That single property removes every habit built around checking where a link goes, which is why attackers are sending millions of them every day.
A call that says it's your bank, the police or tech support can feel completely convincing in the moment. Here is how to check without staying on the line - and why hanging up and calling back yourself is the only test that works.
Got a text that feels off? Here is how to check it safely - how to preview a link without tapping it, the scam patterns currently circulating, and why replying (even STOP) makes things worse.
Ordinary phishing is a net cast at millions. Spear phishing is a message written for you specifically, using real details about your life or work — which is why the usual detection advice fails against it.
Clicking alone is rarely the harmful step. What matters is what happened next — and the right response depends entirely on whether you entered a password, a code, card details, or nothing at all.
Six phishing messages taken from patterns currently in circulation, each broken down line by line — what the attacker is doing, why it works, and the specific detail that gives it away.
Phishing emails are designed to be skimmed, not read. Four checks — sender, urgency, link, and request — catch the overwhelming majority before you click anything, and they run in about ten seconds.
A phishing attack has five stages, and only one of them is the message you see. Understanding the other four explains why the messages look the way they do, and where the chain is easiest to break.