What phishing is
Phishing is a trick that uses a believable message to get you to give up something: a password, a verification code, payment details, or permission to install something harmful. The message pretends to come from a company you know. Because so many people use apps, scammers often borrow the look of app notices, since you expect to hear from apps.
Common message types
Security alerts. “Unusual sign-in detected” or “Your account will be suspended.” The message tells you to tap a link to secure the account. The link leads to a page that looks like the real sign-in but sends your details to the scammer.
Payment and receipt notices. “Your purchase of $X was successful. If this wasn’t you, click here.” The panic of an unknown charge makes you click without thinking. Sometimes there is a phone number to call instead, which connects you to someone who tries to collect your information.
Update prompts. “You must update the app now” with a link. Real updates come through the official store or the app’s own settings, not through a link in a text. Nothing in the text message can be trusted to install safely.
Delivery and service notices. Messages about a package, a missed delivery or an expired subscription, often tied to an app you might plausibly use.
Prize and reward messages. “You have won” or “claim your bonus.” These tie in with the patterns described in fake giveaways.
Verification code requests. A message arrives with a code you did not request, followed by someone asking you to read it back. If you do, they can use it to break into your account.
Friend or support impersonation. A message that appears to come from a friend, or from a support agent, asking for help or a code.
What gives them away
No single sign proves a message is fake, and scammers keep improving. Common clues include:
- Urgency and threats. Short deadlines, warnings about losing your account, and scare language are designed to stop you from thinking.
- Generic greetings. “Dear user” instead of your name, although some phishing does use your name.
- Unexpected contact. You did not do anything that would cause this message.
- Strange addresses. A sender email or phone number that does not match the company, or a link with extra words or odd spelling in the web address.
- Shortened or hidden links. A link that does not show where it leads.
- Odd wording. Mistakes in grammar, spelling or branding, though polished messages exist too.
- Requests for secrets. A real company does not ask you to share your password or a one-time code by message or phone.
How to respond safely
- Do not tap links or open attachments in the message.
- Do not call numbers in the message. Find official contact details yourself.
- Go to the source directly. Open the app from your home screen or type the website address yourself. If there really is a problem, it will usually appear in your account or in the app’s own notices.
- Never share codes or passwords. A code sent by two-step verification is only for you to enter yourself, on a screen you opened.
- Take a moment. Ask someone you trust if you are unsure.
- Report and delete. Use the report option in your messaging or email app, then delete the message.
If you already tapped or entered details
- If you typed a password, change it right away on the real service, and anywhere else you reused it. Using password managers makes unique passwords much easier.
- If you entered card details, call your bank or card provider using the number on your card, and ask what they advise.
- If you shared a verification code, secure the account immediately; the steps in hacked account recovery apply.
- If you installed something because of the message, remove it and apply the checks in mobile malware.
- Watch your accounts and statements for activity you do not recognize in the coming weeks.
Being fooled is not a sign of carelessness. These messages are built to look routine, and they succeed with all kinds of people. Acting quickly afterward matters more than feeling bad.
Habits that help
- Keep your accounts protected with account security basics such as strong passwords and extra sign-in steps.
- Treat any message that asks you to act quickly as a prompt to verify, not a command.
- Be cautious with messages that arrive while you are tired or distracted.
- Keep your phone’s software current so that built-in spam and link warnings work as intended.
- Talk with family members, especially older relatives or children who are new to phones, about how these messages look.
If a message mentions an app, remember that the app itself is the safest place to check. Open it yourself and see what it says.