How to Spot Phishing and Keep Your Password From Scammers

Phishing targets a person rather than a server: someone persuades you to enter a password, an SMS code or card details on a fake page yourself. It remains the most common type of break-in for one reason: it is cheap. Sending thousands of emails costs almost nothing, and one success pays for everything. The good news is that protection is cheap too: attention plus a few habits.

What phishing looks like today

The classic is an email from a "bank" or "mail service" urging you to confirm your account. Messengers and SMS with "parcel tracking" links have joined it, along with fake login pages behind search ads, QR codes on flyers, and emails from "colleagues" with attachments. Neural networks removed the main marker of past years: broken language. The text is now correct and the logos are accurate, so look at technical signs and ignore the style.

Ten rules that cover almost everything

1. Open important services from a bookmark or by typing the address, and skip links in emails.
2. Check the domain in the address bar letter by letter before entering a password.
3. Turn on two-factor verification wherever it exists: a stolen password without the second factor is nearly useless. We explain how it works in the article on two-factor authentication.
4. Move to passkeys where possible: the key is tied to the domain and simply will not work on a fake site.
5. Use a password manager. It fills in a password only on the real domain, so silent autofill on a familiar-looking site is a warning in itself.
6. Do not open attachments you did not expect, even from familiar addresses: the sender may have been hacked.
7. Read SMS codes and push confirmations in full: they state which action you are approving.
8. Keep a separate mailbox for one-off signups and newsletters, and reserve your main one for banks and documents.
9. Update your browser: built-in lists of dangerous sites catch a good share of fakes before the page loads.
10. Tell your family about these tricks: the victim is usually a relative of the person reading articles like this.

Phishing does not only arrive by email

Email is just the oldest channel. The same schemes run in messengers: "vote for my niece", "your parcel is waiting, pay for delivery", a friend's hacked account asking for a loan. The phone version is a call from the "bank security service" pressing you to read out an SMS code. QR codes on tables and posters lead to the same fake pages, only you never see the address. Paid search ads are a separate problem, with the fake sitting above the real site. One rule applies to every channel: a channel does not prove who you are talking to. Only the domain in the address bar and the second factor do.

This works on experienced people too, because it hits your state of mind instead of your knowledge: fatigue, haste, fear of losing money. A scammer creates a time shortage in which checking feels unnecessary. That is why the rules above are meant to work on autopilot, without any thinking.

If an email looks suspicious but you are not sure

Take it apart technically. Open the message source and read the service headers: where it really came from and whether it passed sender authentication. Our email header analyzer shows the server chain and the SPF, DKIM and DMARC results with no manual reading. Run the domain from a link through the DNS lookup: freshly registered throwaway domains have almost no history.

Password already entered: the first half hour

1. Change the password on the real site. If you used it anywhere else, change it there too.
2. End all sessions in your account security settings: stolen passwords are often used within minutes.
3. Check linked email and phone, forwarding rules and backup codes: attackers like to leave themselves a spare way in.
4. If you entered card details, block the card through your bank. That is enough, and a reissue takes care of the rest.
5. Watch the account for a few days. The full list of signs of outside access and the recovery steps are in the article on account hacks.

What phishing cannot do

Knowing the limits of the attack saves you needless worry. Opening an email does not steal a password by itself: the danger starts on a fake page or in a launched attachment. Browsing a site over HTTPS does not hand a scammer your passwords for other services. And you cannot "enter" a passkey or hardware key in the wrong place even on purpose, because the browser will not present it to a foreign domain. The more of your accounts use these methods, the less sense the whole fake page industry makes for you.

Phishing relies on your autopilot: the email presses with urgency and your hand reaches for the link. A ten-second pause with the question "is this the right domain" breaks the whole scheme. The habit costs less than recovering access.