How to Spot a Phishing Email or Text Message: A Practical Checklist
Updated: 10 September 2026 · Reading time: about 10 minutes A phishing message pretends to be a trusted company, service or person so that you will reveal information, send money, install something or open a fake sign-in page. Modern phishing can look polished, use a real logo and mention current events. Spelling mistakes are no longer a reliable test. The safest response Do not use the message’s link, attachment, QR code, phone number or reply button. Open the company’s official app, use a bookmark you already trust, or type a known address yourself. Check the account there. If the alert is real, the same issue will normally appear in the genuine account. A 60-second phishing check Stop. Urgency is designed to shorten your thinking time. Ask whether you expected it. An unexpected invoice, delivery problem, job offer or security alert deserves extra caution. Check the actual sender. A display name can say “Your Bank” while the address belongs to an unrelated...