Phishing tricks you into handing over credentials or running malware by pretending to be someone you trust. It is the entry point for a huge share of breaches — including keylogger infections. The good news: once you know the patterns, most attempts are easy to catch.
Common red flags
- Urgency and fear — “Your account will be closed in 24 hours.” Pressure is designed to stop you thinking.
- Mismatched sender or link — hover over links; the real destination often differs from the text.
- Unexpected attachments — especially documents that ask you to “enable macros” or run something.
- Generic greetings and small errors in grammar, branding, or domain spelling.
- Requests for credentials or codes — legitimate services do not ask for your password or 2FA code.
💡
The golden ruleWhen a message creates urgency about an account, do not use its links. Open the site yourself from a bookmark or by typing the address, and check there.
If you clicked
- Do not enter anything. Close the page.
- If you submitted a password, change it immediately from a trusted device and enable 2FA.
- If you ran an attachment, disconnect from the network and run a full malware scan.
Pairing skepticism with a password manager helps too: managers only auto-fill on the real domain, so a lookalike phishing page quietly won't trigger autofill — a useful warning sign.