A text from your bank warning you about a suspicious login. An email from the courier about a parcel on hold. A message from an unknown number saying "Hi Mum, I've got a new phone". They look normal, and that is exactly the point. Phishing is the most widespread online scam in the world because it does not attack the computer: it attacks people's trust.

In this guide you will learn to recognise scam messages, understand the most common variants today and know exactly what to do if you have already clicked.

What phishing is

Phishing is a technique in which scammers pretend to be a company or person you trust to convince you to do something: enter a password, share your card details, install an app or make a bank transfer. The name comes from fishing: bait is cast to thousands of people, and the scammers wait for someone to bite.

The most common forms

  • Email: fake messages from banks, postal services, couriers, streaming services, energy suppliers or public bodies.
  • SMS (smishing): short messages with a link, often about parcels to release, fines to pay or suspicious account logins.
  • Phone calls (vishing): a fake bank or police officer asks for codes or tells you to move your money to a "safe account".
  • Messaging apps and social media: fake relatives in trouble, fake prizes, fake job offers.
  • Clone websites: perfect copies of real sites, reached through ads or sponsored search results.

Signs that a message is a scam

  • Urgency and fear: "your account will be blocked within 24 hours", "final notice". The rush is there to stop you thinking.
  • Odd sender: the email address or number does not match the official ones, even if the display name looks right.
  • Suspicious links: the address contains typos, extra words or unusual domains. On a computer, hover over the link without clicking to see where it really goes.
  • Requests for confidential data: no bank will ever ask for passwords, PINs or codes by email, text or phone.
  • Generic greetings such as "Dear customer" and text with small errors or odd translations.
  • Unexpected attachments, especially compressed files or documents asking you to "enable content".
  • Offers too good to be true: prizes, refunds, smartphones for one euro.

Why careful people fall for it too

Today's phishing messages are far more polished than a few years ago: perfect logos, correct language, websites identical to the originals, sometimes even the padlock in the address bar. The padlock only means the connection is encrypted, not that the site is the real one. Scam texts can even appear in the same conversation thread as genuine messages from your bank.

That is why common sense alone is not enough: there will be a moment of tiredness or distraction when anyone can make a mistake.

How to protect yourself in practice

  • Do not click links in messages: open the official website or app by typing the address yourself or using your bookmarks.
  • Always verify another way: if the bank contacts you, hang up and call the official number yourself.
  • Turn on two-step verification for email, banking and social media: even if your password is stolen, it is not enough to get in.
  • Use a password manager: it only autofills passwords on the real sites and not on clones. That is a great warning sign.
  • Use anti-phishing protection: modern security suites check the links you open in real time and block scam sites before they load, even ones created just hours ago.
  • Keep your phone, computer and browser up to date.

What to do if you have already clicked

Stay calm and act fast, in this order:

  • If you entered bank or card details: immediately call your bank's official number and have the card or online banking access blocked.
  • If you entered a password: change it right away, and change it on every other site where you used it.
  • Turn on two-step verification for the affected accounts.
  • If you installed an app or downloaded a file: uninstall it and run a full scan with an up-to-date antivirus.
  • Check your account and card transactions over the following days.
  • Report it to the police or your national cybercrime authority, and report the message to the bank or company being impersonated.

In short

Phishing works because it exploits haste, fear and trust. Recognising the signs, always verifying another way and adding anti-phishing protection to your common sense drastically reduce the risk of falling into the trap.

Do not wait to find out from your bank statement. With our free quiz you can find the best protection for your devices in one minute, at the best price available.