Phishing messages no longer need obvious spelling mistakes to look convincing. A message can be polished, personal and professionally formatted while still trying to push you toward a harmful link or a fake sign-in page. The safest habit is to judge the request and the destination, not the grammar.
Start with the request
Pause when a message asks for a password, payment, security code, personal information or an urgent account action. CISA lists urgency, emotional pressure and requests for financial or personal information as common warning signs. A familiar logo or a name that looks like someone you know does not prove the message is authentic.
Inspect the destination without clicking
On a computer, hover over the link. On a phone, press and hold only if your app shows the destination safely without opening it. Look for misspelled domains, unexpected subdomains, shortened links and addresses that use a familiar brand name inside an unrelated domain. If the message might be real, open the company website by typing its address yourself or using a bookmark you already trust.
Use a separate verification route
Do not call the phone number in a suspicious message. Find the organization’s contact information on its official website, or contact the person through a different channel. This matters especially for invoices, delivery notices, password resets and messages that appear to come from a manager.
What to do after you identify it
Do not reply, click an unsubscribe link or open the attachment. Report the message through your email or messaging service, then delete it. If you entered a password, change it from the real website, turn on multi-factor authentication and review recent account activity. If financial information was exposed, contact the financial institution using the number on its official card or statement.
For a related guide to safer everyday browsing, see how to use Firefox split view without opening unknown pages in separate windows.
