Phishing attacks explained — identify and avoid them

Note: This site may show light ads and occasional affiliate links. How that works.

Phishing is a message built to make you act before you think — click, sign in, send money, or share a code. The brand looks familiar. The pressure is the point, and that pressure works on security teams as readily as anyone else when the timing is wrong.

You do not need to catch every variant. You need a slow habit for anything that wants your login or your cash — and the habit is the same whether you run the mail server or just read the inbox.

Never enter a password from a link in an unexpected message. Open the site yourself from a bookmark or by typing the address.

Common UK shapes

Fake bank or HMRC urgency, parcel “fees,” prize claims, IT password resets, invoice PDFs with a twist. Compensation emails and “your device is compromised” surveys turn up often.

Checks that still work

Hover or long-press to preview the real web address
Look for urgency and secrecy together
Compare the sender domain carefully — rnicrosoft-style tricks still work
Use a known app or typed address for banking
Report and delete — do not “test” the link

At the moment of risk

Stop! Pause! Is it urgent? Do you know who it is from? Is it really from who it says it is? If the answer is not sure or no — do not click. Check another way.

If you clicked

Change the password from a different device if you can. Turn on multi-factor authentication (mfa). Check email forwarding rules. Tell your bank if money or card details were involved. Report via Action Fraud.

A self-check

Think of the last message that made you rush — a parcel fee, a password reset, an invoice you were not expecting. Did you pause, or did urgency decide for you? Next time that mood hits — tired, busy, something saying “account locks in 15 minutes” — plan your pause before you open the message.