Spot the phish before you touch the bait
The message wants speed. Your defense is verification.
Phishing works by making the next step feel automatic: click, sign in, pay, download, or reply. Break that rhythm before you inspect the message.
Run the five-second test
- Was I expecting this?An unexpected invoice, reset, delivery, or security alert deserves a pause.
- Is it forcing urgency?Threats, deadlines, and secrecy are pressure tools.
- What is it asking for?Passwords, codes, payment, personal data, links, and attachments raise the risk.
- Can I verify another way?Open the official app, use a saved contact, or type the known site address yourself.
If you already clicked
Do not keep entering information. Close the page. If you entered a password, change it from a trusted device and end active sessions. If a file downloaded, update your security software and run a scan. Contact the affected company through a channel you know is real.
The ruleDo not use the phone number, reply address, or link supplied by the suspicious message to verify that same message.
Primary source: FTC guidance on recognizing and avoiding phishing ↗