How to Spot a Phishing Message in 30 Seconds

Most account break-ins don't start with clever hacking. They start with a message that looks normal — a parcel that "couldn't be delivered", a bank asking you to "confirm your details", a friend who suddenly needs a code you just received. That's phishing: a fake message built to get you to click, sign in or share something.

The good news: almost every phishing message has the same few tells. Learn them once and you can check any message in about 30 seconds.

The 30-second check

Before you tap anything, ask these five questions.

1. Did I expect this?

A delivery note for a parcel you never ordered, a "new sign-in" alert you didn't cause, a prize you never entered for. A message you weren't waiting for is the first warning sign.

2. Is it rushing me?

"Your account will be closed in 24 hours." "Pay now to avoid a fine." Pressure is the scammer's main tool, because people who hurry don't check. A real company almost never needs you to act within minutes.

3. Who really sent it?

Look past the display name. On email, tap the sender to see the full address: `[email protected]` is not your bank. On text messages, a random number or an unusual short code is a warning sign — and remember that the sender name on a text can be faked.

4. Where does the link really go?

On iPhone, press and hold a link to preview where it leads without opening it. Read the web address from right to left, starting at the first single slash: in `yourbank.com.account-check.net/login`, the real website is `account-check.net`, not your bank.

5. What is it asking for?

Your password, a one-time code, your card number, or an app to install. Real services don't ask for your password or your sign-in code by message — ever. Anyone who asks you to read back a code you just received is trying to sign in as you.

If you answer "no", "yes", "not sure", "somewhere odd" or "something private" to any of these, stop.

What to do instead of clicking

Go the long way round. Open the company's app, or type its website address yourself, and check your account there. If the problem is real, you'll see it.

Call back on a number you already know — the one on your card or the company's own website, never the one in the message.

Ask the friend another way. If a friend asks for money or a code, call or message them on a different app before you do anything.

If you already clicked

It happens to careful people too. Act quickly:

Change the password of the account you typed in — and of every account that uses the same password.

Turn on two-factor authentication if it isn't on yet. Our guide Two-Factor Authentication: The Order to Turn It On shows where to start.

Call your bank straight away if you shared card or banking details.

Report the message. Most email apps have a "report phishing" or "report junk" option, and your bank will want to know about fakes using its name.

What a VPN does — and doesn't — do here

A VPN encrypts your connection, which protects you on public Wi-Fi and hides your browsing from the network you're on. It does not make a fake website real, and it cannot stop you from typing a password into a page that was built to steal it. The 30-second check is still your best defence.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Download CasperVPN →